| Summary: | "subsystem request for sftp" log entry can't be correlated with a user | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Portable OpenSSH | Reporter: | TenToThe9 | ||||
| Component: | sshd | Assignee: | Assigned to nobody <unassigned-bugs> | ||||
| Status: | CLOSED FIXED | ||||||
| Severity: | enhancement | CC: | djm | ||||
| Priority: | P2 | ||||||
| Version: | 5.2p1 | ||||||
| Hardware: | Other | ||||||
| OS: | Linux | ||||||
| Bug Depends on: | |||||||
| Bug Blocks: | 1708 | ||||||
| Attachments: |
|
||||||
|
Description
TenToThe9
2009-03-11 02:17:14 AEDT
We don't log the user in all log entries because they can be correlated by PID, which your syslogd should record. That's just the problem: the pid in the "subsystem requested" line does not match the pid in the "Accepted ... for ..." line. This might be because of privilege separation. The privsep child pid is logged at loglevel=verbose, but it isn't hard to add the username to the message. I'll make a diff. Created attachment 1872 [details]
/home/djm/sshd-subsys-req-log-user.diff
log username on subsystem request line
patch applied - this will be in OpenSSH-5.6 Move resolved bugs to CLOSED after 5.7 release |