Sunday, September 24, 2023
 Popular · Latest · Hot · Upcoming
rated 0 times [  19] [ 0]  / answers: 1 / hits: 49305  / 2 Years ago, tue, september 28, 2021, 12:32:01

I want to remove any and all activity logs for SSH remotely. How do I get to it?

My account on the remote server doesn't have admin privilege, and as such I just want to remove user to user connection records.

More From » ssh


The answer to this lies in sshd.conf and sshd_config (server) and ssh_config (client). Depending on the log level it logs to /var/log/syslog (default) and/or /var/log/auth.log (loglevel 'verbose' contains ssh login attempts).

If present /var/log/secure also contains an access log.

You will need root/sudo access to edit any of these files: they will be word-readable but not world-editable.

Next to that. Besides the login from the ssh daemon the command last also shows (failed) logins from ssh. The information for this command comes from /var/log/wtmp (There will be several more I bet).

And there is also the probability the sysadmin installed auditd or logwatch making it practically impossible to hide activity since they could get a notice based on activity undoing the registration of the ssh activity impossible.

Example of /var/log/auth.log:

Aug 10 10:10:10 rinzwind sshd[3653]: Invalid user text from {ipadress}
Aug 10 10:10:10 rinzwind sshd[3653]: Excess permission or bad ownership on file /var/log/btmp
Aug 10 10:10:10 rinzwind sshd[3653]: error: Could not get shadow information for NOUSER
Aug 10 10:10:10 rinzwind sshd[3653]: Failed password for invalid user test from {ipadress} port {port} ssh2
Aug 10 10:10:10 rinzwind sshd[3653]: Excess permission or bad ownership on file /var/log/btmp

[#43814] Wednesday, September 29, 2021, 2 Years  [reply] [flag answer]
Only authorized users can answer the question. Please sign in first, or register a free account.

Total Points: 299
Total Questions: 116
Total Answers: 111

Location: Wales
Member since Tue, Dec 14, 2021
2 Years ago
rieency questions
Wed, Aug 25, 21, 15:17, 2 Years ago
Wed, Jun 23, 21, 04:37, 2 Years ago
Fri, Sep 30, 22, 12:07, 1 Year ago
Thu, Feb 24, 22, 00:50, 2 Years ago
Mon, Mar 28, 22, 13:28, 2 Years ago