Commands
This guide aims to equip you with the knowledge needed to install ELK stack on RHEL9 | CentOS9 effortlessly. By following these steps, you can
Learn how to monitor SSH logins using Auditd and Logwatch on Linux. This step-by-step guide covers setup, configuration, log analysis, and reporting to enhance server security.
Secure Shell (SSH) is one of the most widely used methods for remote server administration. Because it provides a gateway into critical infrastructure, monitoring SSH activity is a fundamental part of system security. Attackers often attempt brute-force logins, exploit weak credentials, or hijack valid accounts. To detect these activities, system administrators can rely on auditd and Logwatch, two robust tools for auditing and log analysis.
This guide explains how to configure and use auditd and Logwatch to track SSH logins, generate reports, and strengthen system visibility.
Monitoring SSH login activity is critical for the following reasons:
|
|
|
|
| Benefit | Description |
|---|---|
| Security | Detect malicious login attempts and prevent breaches |
| Compliance | Maintain detailed audit logs for regulatory requirements |
| Accountability | Associate login actions with specific users |
| Troubleshooting | Identify failed login attempts and misconfigurations |
Before diving into configuration, let’s break down the roles of these tools:
|
|
Together, they provide real-time auditing and human-readable summaries.
Most modern Linux distributions (RHEL, CentOS, Ubuntu, Debian) ship with these tools in their repositories.
# RHEL / CentOS / Fedora
sudo dnf install audit audit-libs logwatch -y
# Ubuntu / Debian
sudo apt update
sudo apt install auditd logwatch -y
Enable and start the auditd service:
sudo systemctl enable --now auditd
Auditd uses rules to determine what events to log. For SSH logins, focus on authentication events recorded in /var/log/secure (RHEL-based) or /var/log/auth.log (Debian-based).
🔹Add an Audit Rule |
Create a rule to watch SSH-related binaries:
sudo auditctl -w /usr/sbin/sshd -p x -k ssh_logins
|
|
|
Make the rule persistent by adding it to /etc/audit/rules.d/audit.rules:
-w /usr/sbin/sshd -p x -k ssh_logins
🔹Reload Rules |
sudo augenrules --load
SSH login attempts are now captured. Check the audit logs:
sudo ausearch -k ssh_logins
Output example:
type=EXECVE msg=audit(1695409657.123:456): argc=3 a0="sshd" a1="-D" a2="-f"
type=SYSCALL msg=audit(1695409657.123:456): arch=c000003e syscall=59 success=yes ...
You can also query specific user logins:
sudo ausearch -ua 1001 -k ssh_logins
Logwatch generates daily summaries of logs, including SSH login attempts.
🔹Run Logwatch Manually |
sudo logwatch --service sshd --detail high --range today
Sample output:
--------------------- SSHD Begin ------------------------
Authentication Failures:
root (203.0.113.45): 25 times
admin (198.51.100.23): 12 times
Successful Logins:
user1 (192.0.2.10): Thu Sep 21 10:35:12
---------------------- SSHD End -------------------------
🔹Automating Reports |
By default, Logwatch runs as a daily cron job and sends reports via email to the system administrator (root@localhost). To customize, edit /etc/logwatch/conf/logwatch.conf:
MailTo = admin@example.com
Detail = Med
Service = sshd
Auditd logs offer granular details, while Logwatch provides digest summaries. By combining both:
|
|
| Tool | Purpose | Strength |
|---|---|---|
| Auditd | System auditing | Granular, kernel-level logging |
| Logwatch | Log analysis | Human-readable reports, email alerts |
🔹Filtering Auditd Logs |
Extract only SSH failures:
sudo ausearch -m USER_LOGIN -sv no
🔹Scheduling Reports |
Add Logwatch to systemd timers or cron jobs for more frequent monitoring:
0 */6 * * * /usr/sbin/logwatch --service sshd --detail high --range today
🔹Integrating with SIEM |
Forward audit logs to a Security Information and Event Management (SIEM) tool (e.g., Splunk, ELK) for centralized monitoring.
|
|
|
|
|
| Issue | Possible Fix |
|---|---|
| No logs generated | Ensure auditd is running (systemctl status auditd) |
| Logwatch not sending email | Check /etc/logwatch/conf/logwatch.conf for MailTo settings |
| Too many logs | Use filters in ausearch or adjust Logwatch Detail level |
| Duplicate reports | Ensure Logwatch is not triggered by multiple cron jobs |
This guide aims to equip you with the knowledge needed to install ELK stack on RHEL9 | CentOS9 effortlessly. By following these steps, you can
Learn how to monitor SSL certificate expiry using Zabbix with automated scripts and triggers. Avoid service disruptions by setting up alerts for expiring certificates. Table