X-Recipient:	archive-cygwin AT delorie DOT com
X-SWARE-Spam-Status:	No, hits=-0.4 required=5.0 tests=AWL,BAYES_20,FREEMAIL_FROM,RCVD_IN_DNSWL_LOW,SARE_FREE_WEBM_LAPOSTE,T_RP_MATCHES_RCVD,T_TO_NO_BRKTS_FREEMAIL
X-Spam-Check-By:	sourceware.org
Message-ID:	<4DB889D9.2070703@laposte.net>
Date:	Wed, 27 Apr 2011 23:25:45 +0200
From:	Cyrille Lefevre <cyrille DOT lefevre-lists AT laposte DOT net>
User-Agent:	Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.8.1.3) Gecko/20070326 Thunderbird/2.0.0.0 Mnenhy/0.7.5.666
MIME-Version:	1.0
To:	cygwin AT cygwin DOT com
Subject:	Re: Enable logging remote ssh contacts
References:	<31478200 DOT post AT talk DOT nabble DOT com> <20110426132128 DOT GA6293 AT jethro DOT local DOT lan> <31478748 DOT post AT talk DOT nabble DOT com> <4DB6E0EA DOT 8070901 AT cygwin DOT com> <31481290 DOT post AT talk DOT nabble DOT com> <ip7d1h$tt4$1 AT dough DOT gmane DOT org> <31484865 DOT post AT talk DOT nabble DOT com> <31485107 DOT post AT talk DOT nabble DOT com> <ip9h0a$39g$1 AT dough DOT gmane DOT org> <31490012 DOT post AT talk DOT nabble DOT com>
In-Reply-To:	<31490012.post@talk.nabble.com>
X-me-spamlevel:	not-spam
X-me-spamrating:	28.000000
X-me-spamcause:	OK, (-300)(0000)gggruggvucftvghtrhhoucdtuddrfedukedrtdduucetggdotefuucfrrhhofhhilhgvmecuoehnohhnvgeqnecuuegrihhlohhuthemuceftddtnecurhhoohhtpdhushhrpdhlohgtrghlfeigucdlqdeftddtmd
X-IsSubscribed:	yes
Mailing-List:	contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Id:	<cygwin.cygwin.com>
List-Subscribe:	<mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive:	<http://sourceware.org/ml/cygwin/>
List-Post:	<mailto:cygwin AT cygwin DOT com>
List-Help:	<mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender:	cygwin-owner AT cygwin DOT com
Mail-Followup-To:	cygwin AT cygwin DOT com
Delivered-To:	mailing list cygwin AT cygwin DOT com

Le 27/04/2011 20:49, Fokke Nauta a =C3=A9crit :
Hi,

> I don't have any ll in the shell. Not recognized.
> So I can't see the
> I have syslog-ng running. Should I replace that by autossh?

syslogd must be started before sshd... does it ?

let's try configuring both services differently :

# backup the actual configuration
cygrunsrv -VQ syslogd > syslogd.cfg
cygrunsrv -VQ sshd > sshd.cfg

# stop the services
cygrunsrv -E syslogd
cygrunsrv -E sshd

# remove the services
cygrunsrv -R syslogd
cygrunsrv -R sshd

# reconfigure the services using the .cfg parameters if different

# -y tcpip may be added but in this case, sshd should depend on
# syslogd sshd (see the alternative below)
cygrunsrv -I syslogd -p /usr/sbin/syslogd \
-d "CYGWIN syslog daemon" -u LocalSystem -w ''

# since tcpip doesn't start too early, syslogd has the time
# to start before sshd does...
cygrunsrv -I sshd -p /usr/sbin/sshd -a "-D" \
-d "CYGWIN ssh daemon" -f "8022" -u cyg_server -w <password> \
-y tcpip -e "CYGWIN=3Dtty" # ntsec if XP, tty isn't necessary.

# alternative, don't touch the syslogd service but provide it
# as an sshd depedency...
cygrunsrv -I sshd -p /usr/sbin/sshd -a "-D" \
-d "CYGWIN ssh daemon" -f "8022" -u cyg_server -w <password> \
-y tcpip -y syslogd -e "CYGWIN=3Dtty" # ntsec if XP, tty isn't necessary.

# start the services
cygrunsrv -S syslogd
cygrunsrv -S sshd

although, permission check (under vista at least, don't know under XP)

somebody AT somewhere /var/log
v2$ ls -ld . messages
drwxrwxrwx+ 1 somebody None       0 Mar 31 00:38 .
-rw-rw-r--+ 1 SYSTEM   root 3495748 Apr  3 15:26 messages
----------^ note the + here =3D> acl

somebody AT somewhere /var/log
v2$ getfacl . messages
# file: .
# owner: somebody
# group: None
user::rwx
group::rwx
group:root:rwx
group:SYSTEM:rwx
mask:rwx
other:rwx
default:user::rwx
default:group::rwx
default:group:root:rwx
default:group:SYSTEM:rwx
default:group:Utilisateurs:r-x
default:mask:rwx
default:other:rwx

# file: messages
# owner: SYSTEM
# group: root
user::rw-
group::rw-
group:Utilisateurs:r-x
mask:rwx
other:r--

at last, I prefer the VERBOSE log level than the info one :

somebody AT somewhere /var/log
v2$ grep Level /etc/sshd_config
LogLevel VERBOSE


Regards,

Cyrille Lefevre
--=20
mailto:Cyrille DOT Lefevre-lists AT laposte DOT net



--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

- Raw text -