In its default configuration, SSH already creates log entries whenever someone logs in via SSH, SCP, or SFTP. On Debian/Ubuntu systems, the entry is made in the /var/log/auth.log file. On Red Hat/CentOS systems, the entry is made in the /var/log/secure file. Either way, the log entry looks something like this:
Oct 1 15:03:23 donnie-ca sshd[1141]: Accepted password for donnie from 192.168.0.225 port 54422 ssh2
Oct 1 15:03:24 donnie-ca sshd[1141]: pam_unix(sshd:session): session opened for user donnie by (uid=0)
Open the sshd_config man page and scroll down to the LogLevel item. There, you'll see the various settings that provide different levels of detail for logging SSH messages. The levels are as follows:
- QUIET
- FATAL
- ERROR
- INFO
- VERBOSE
- DEBUG or DEBUG1
- DEBUG2
- DEBUG3
Normally, the only two of these we would care about are INFO and VERBOSE...
