Configuring syslog-ng

By: woodsy_ca

July 28, 2009 2:28 pm





I’ve recently configured a new file transfer server based on SLES 10. This replaces an aging NetWare 6.5 server. I have it configured for file transfers via FTP (using vsftpd) and SFTP. FTP uses tcp-wrappers to limit external access via IP address. Both FTP and SFTP users are chroot’d to their home directories. To get this working, I had to install install OpenSSH 5.2 (and pre-requsites); the older version of OpenSSH included with SLES 10 does not support chroot directly. I followed DamianMyerscough‘s excellent series on SSH to get this working:

SSH (Secure Shell) Tricks III

I also found the following article very helpful:
Setup of a chroot’d SFTP only server

The server went live about a week ago, and everything seemed good. Unfortunately, despite my advanced notice and repeated requests for testing from the user groups, it really wasn’t working at all. That is, it was working fine internally (via FTP), but file transfers from an outside vendor (using SFTP) were not working.

Of course, this is when I really discovered that logging was an issue. While vsftpd worked great and provided full file transfer details, I was only getting connection information from SSH and SFTP. Clearly this needed to be fixed. But, as usual, it wasn’t as straightforward as it sounded. (Every time I think I am getting somewhere with Linux, I discover how much I just don’t know yet.)

The long and short of the story is that I do have it working, after about a day and a half. And I now know more about the configuration of syslog-ng than I ever wanted to (In fact, I didn’t even know what syslog-ng was before yesterday).

And, again, DamianMyerscough was my rescuer. He is rapidly becoming my favourite Novell Communities author. At any rate, he posted an article last year about getting SSH to log somewhere other than /var/log/messages. This got me pointed in the right direction to configuring syslog-ng to get the logging working properly. I have entered my solution at the end of the article:

Syslog-ng – SSH Logging

Some other articles that helped me get this working (I like to give credit where I can):
/var/log/messages internal-sftp time stamp problem
syslog-ng, chroot environments & Solaris
Syslog-ng.conf Examples

0 votes, average: 0.00 out of 50 votes, average: 0.00 out of 50 votes, average: 0.00 out of 50 votes, average: 0.00 out of 50 votes, average: 0.00 out of 5 (0 votes, average: 0.00 out of 5)
You need to be a registered member to rate this post.

Tags: , ,
Categories: SUSE Linux Enterprise Server, Technical Solutions

Disclaimer: As with everything else in the SUSE Blog, this content is definitely not supported by SUSE (so don't even think of calling Support if you try something and it blows up).  It was contributed by a community member and is published "as is." It seems to have worked for at least one person, and might work for you. But please be sure to test, test, test before you do anything drastic with it.

1 Comment

  1. By:trixie1982

    Thanks for the Links, helped me !!!!