Auditing user login/logout events

[trifo]

Hi!

I would need to have someting like the output of last command sent to syslog. The information including who logged in from where, and when.

Now, I am fiddling with audit subsystem, but I am unable to get it collecting ftp/rsh login/logout data. Is there an easy way to accomplish this goal?

--Trifo

 

[khalidaaa]

Why don't you use ssh and sftp instead! they are more secure!

Have a look here:

http://forums.devshed.com/bsd-help-31/logging-ssh-shell-sessions-30398.html

Regards,
Khalid

 

[trifo]

Mostly I use ssh and sftp, which logs auth info in the syslog well. Even though sometimes I need to use legacy servives as well, and at least I need to keep track if they are used.

I will have to hand over these boxes to a new admin and I want these event logs to be enabled when the handover is done.

--Trifo

 

[trifo]

Reading some more docs, I found, that the info I want to obtain may meg gained from _accounting_, not from _auditing_. The accounting - along other sources - processes wtmp info, which I need.

The only problem is that it is designed to run accounting daily. I would like to obtain wtmp info real time in syslog.

--Trifo