Linux Logging

Limit Logging from SSH Session

• To avoid logging in /var/log/wtmp

ssh [email protected] bash -c /bin/sh
OR
ssh [email protected] bash -i
OR 
ssh [email protected] /bin/sh <-- Best option

Finding Writable Directories for your Current User

find / -type d -perm -0222 2>/dev/null

• Good hiding spots are tmpfs file systems. Run the mount command to view tmpfs filesystems:

/dev/shm

Unix Logging

• Main log files can be identified by viewing

/etc/syslog.conf

• Majority of the log files are located in:

/var/log

Hiding Shell History

• Kill bash shell and prevent command writing to .bash_history

kill -9 $$

• Dont save history for shell session, run as your first command when you get on a box

unset HISTFILE HISTFILESIZE HISTSIZE PROMPT_COMMAND

• On some distributions adding a leading space will prevent the command from writing (old distros)

• This will only work if the environmental variable HISTCONTROL is set to ignorespace

Accounting Entries in Unix

• Currently logged in users

• Distro Dependent

/var/log/utmp

• Successful login attempts

/var/log/wtmp

• Unsuccessful login attempts

• Some admins will turn this off, so evidence of miss typed password in the username field are not saved

/var/log/btmp

• File to show login name, port, and last login time for each user

/var/log/lastlog

• These are binary files and need special tools in order to edit

Log Files to Check

/var/log/auth.log
/var/log/syslog
/var/log/messages
/var/spool/mail/root
/var/log/secure
/var/log/cron
/var/log/httpd/access_log*
/var/log/httpd/error_log*
##Dont forget the journel##

Syslog

• Key files

Filename	Purpose
auth.log	System authentication and security events
boot.log	A record of boot-related events
dmesg	Kernel-ring buffer events related to device drivers
dpkg.log	Software package-management events
kern.log	Linux kernel events
syslog	A collection of all logs
wtmp	Tracks user sessions (accessed through the who and last commands)

• Logging level

Level	Description
debug	Helpful for debugging
info	Informational
notice	Normal conditions
warn	Conditions requiring warnings
err	Error conditions
crit	Critical conditions
alert	Immediate action required
emerg	System unusable