X-Recipient: archive-cygwin@delorie.com
X-SWARE-Spam-Status: No, hits=-0.4 required=5.0	tests=AWL,BAYES_20,FREEMAIL_FROM,RCVD_IN_DNSWL_LOW,SARE_FREE_WEBM_LAPOSTE,T_RP_MATCHES_RCVD,T_TO_NO_BRKTS_FREEMAIL
X-Spam-Check-By: sourceware.org
Message-ID: <4DB889D9.2070703@laposte.net>
Date: Wed, 27 Apr 2011 23:25:45 +0200
From: Cyrille Lefevre <cyrille.lefevre-lists@laposte.net>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.8.1.3) Gecko/20070326 Thunderbird/2.0.0.0 Mnenhy/0.7.5.666
MIME-Version: 1.0
To: cygwin@cygwin.com
Subject: Re: Enable logging remote ssh contacts
References: <31478200.post@talk.nabble.com> <20110426132128.GA6293@jethro.local.lan> <31478748.post@talk.nabble.com> <4DB6E0EA.8070901@cygwin.com> <31481290.post@talk.nabble.com> <ip7d1h$tt4$1@dough.gmane.org> <31484865.post@talk.nabble.com> <31485107.post@talk.nabble.com> <ip9h0a$39g$1@dough.gmane.org> <31490012.post@talk.nabble.com>
In-Reply-To: <31490012.post@talk.nabble.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: quoted-printable
X-me-spamlevel: not-spam
X-me-spamrating: 28.000000
X-me-spamcause:  OK, (-300)(0000)gggruggvucftvghtrhhoucdtuddrfedukedrtdduucetggdotefuucfrrhhofhhilhgvmecuoehnohhnvgeqnecuuegrihhlohhuthemuceftddtnecurhhoohhtpdhushhrpdhlohgtrghlfeigucdlqdeftddtmd
X-IsSubscribed: yes
Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm
List-Id: <cygwin.cygwin.com>
List-Subscribe: <mailto:cygwin-subscribe@cygwin.com>
List-Archive: <http://sourceware.org/ml/cygwin/>
List-Post: <mailto:cygwin@cygwin.com>
List-Help: <mailto:cygwin-help@cygwin.com>, <http://sourceware.org/ml/#faqs>
Sender: cygwin-owner@cygwin.com
Mail-Followup-To: cygwin@cygwin.com
Delivered-To: mailing list cygwin@cygwin.com


Le 27/04/2011 20:49, Fokke Nauta a =C3=A9crit :
Hi,

> I don't have any ll in the shell. Not recognized.
> So I can't see the
> I have syslog-ng running. Should I replace that by autossh?

syslogd must be started before sshd... does it ?

let's try configuring both services differently :

# backup the actual configuration
cygrunsrv -VQ syslogd > syslogd.cfg
cygrunsrv -VQ sshd > sshd.cfg

# stop the services
cygrunsrv -E syslogd
cygrunsrv -E sshd

# remove the services
cygrunsrv -R syslogd
cygrunsrv -R sshd

# reconfigure the services using the .cfg parameters if different

# -y tcpip may be added but in this case, sshd should depend on
# syslogd sshd (see the alternative below)
cygrunsrv -I syslogd -p /usr/sbin/syslogd \
-d "CYGWIN syslog daemon" -u LocalSystem -w ''

# since tcpip doesn't start too early, syslogd has the time
# to start before sshd does...
cygrunsrv -I sshd -p /usr/sbin/sshd -a "-D" \
-d "CYGWIN ssh daemon" -f "8022" -u cyg_server -w <password> \
-y tcpip -e "CYGWIN=3Dtty" # ntsec if XP, tty isn't necessary.

# alternative, don't touch the syslogd service but provide it
# as an sshd depedency...
cygrunsrv -I sshd -p /usr/sbin/sshd -a "-D" \
-d "CYGWIN ssh daemon" -f "8022" -u cyg_server -w <password> \
-y tcpip -y syslogd -e "CYGWIN=3Dtty" # ntsec if XP, tty isn't necessary.

# start the services
cygrunsrv -S syslogd
cygrunsrv -S sshd

although, permission check (under vista at least, don't know under XP)

somebody@somewhere /var/log
v2$ ls -ld . messages
drwxrwxrwx+ 1 somebody None       0 Mar 31 00:38 .
-rw-rw-r--+ 1 SYSTEM   root 3495748 Apr  3 15:26 messages
----------^ note the + here =3D> acl

somebody@somewhere /var/log
v2$ getfacl . messages
# file: .
# owner: somebody
# group: None
user::rwx
group::rwx
group:root:rwx
group:SYSTEM:rwx
mask:rwx
other:rwx
default:user::rwx
default:group::rwx
default:group:root:rwx
default:group:SYSTEM:rwx
default:group:Utilisateurs:r-x
default:mask:rwx
default:other:rwx

# file: messages
# owner: SYSTEM
# group: root
user::rw-
group::rw-
group:Utilisateurs:r-x
mask:rwx
other:r--

at last, I prefer the VERBOSE log level than the info one :

somebody@somewhere /var/log
v2$ grep Level /etc/sshd_config
LogLevel VERBOSE


Regards,

Cyrille Lefevre
--=20
mailto:Cyrille.Lefevre-lists@laposte.net



--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple