List of users connected by sftp.

[amscotti]

Hi,

I been playing around with OpenBSD 4.4 for abit now but still trying to learn somethings. Its sounds like should be easy but I just can't seem to find any help on Google. Maybe I'm just not looking for the right thing.

Right now, I have setup a users for sftp only that are chroot to there home folder. Everything is working fine with the chroot/sftp but I'm just not sure how to tell if there are users on the system connected by sftp.

who and w only show myself on the system. Is there a other way to tell?

Thanks for the help!

[jggimi]

I can't do any testing right now; but I think that sftp can be logged if you set up the appropriate subsystem. See the sftp-server(8) man page, and the Subsystem discussion in sshd_config(5).

[amscotti]

Thanks for the reply jggimi,

I'm using the "internal-sftp" subsystem in my sshd_config file. So, from the sftp-server(8) man page I would want to add a -f AUTH -l ERROR to start logging, Right?

Full line would read,

Subsystem       sftp    internal-sftp -f AUTH -l ERROR

Thanks for the help

[jggimi]

I do not know if the internal-sftp feature can log or not. From my interpretation of the man page, these syslog options are only usable with sftp-server.

[amscotti]

I changed the line in my sshd_config file and added -f AUTH -l ERROR. Restarted the sshd and now it seem to be logging to my /var/log/authlog file which is very great!

Thanks jggimi!

Also, Is there be a way to run a command to show the uses log on? like something I could run before shutting down or restarting the computer?

Thanks for the help!

[jggimi]

I think you asked the same question in your first post.

I'm not aware of any such command in the OS, nor, am I aware of one in the ports/package system. I would think that if sftp-server or internal-sftp used utmp/wtmp, the standard user tools like w(1) could be used.

[amscotti]

Originally Posted by jggimi

I think you asked the same question in your first post.

Yup, you are right. Logging was going to be the next thing I asked tho.

Originally Posted by jggimi

I'm not aware of any such command in the OS, nor, am I aware of one in the ports/package system. I would think that if sftp-server or internal-sftp used utmp/wtmp, the standard user tools like w(1) could be used.

I'll look in to utmp/wtmp.

Thanks for all the help jggimi!

[BSDfan666]

Connections via sftp aren't considered interactive logins, thus.. are not registered via utmp(5)/wmtp.

While you're free to look at the relevant man pages amscotti, they are a programming API.. not programs.

Sorry, but it's still easy to determine active connections with a little more.. work.

$ fstat | grep internet | grep "<--" | grep "sshd" | grep -v "root" | cut -d ' ' -f 1

It's a little primitive, but.. it'll get the job done.