Why is rsync over ssh is not being shown in journalctl entries?

AndrzejL · 2013-11-10 22:57:06

Hi there.

I am not sure if I started this topic in the correct section of the forum - if I didn't I apologize. Please move it. Thanks.

I know that the question may seem idiotic. Bare with me - it is not.

IF a person logs into the ssh server box (ie. ssh -p 69 -l someuser someipordomain) and the admin has let's say:

 journalctl -b -f --no-pager

command running he / she could see entry similar to this:

Nov 10 22:39:28 hostnameblah sshd[694]: Accepted publickey for someuser from aaa.ccc.xxx.yyy port abcde ssh2: RSA aa:bb:cc:dd:ee:ff:gg:hh:ii:jj:kk:ll:mm:nn:oo:pp

Now... IF however the same user was to run command like:

rsync -avz -P --delete --exclude 'SomeFolder' --exclude 'SomeFolder2' --exclude 'SomeFolder3' -e 'ssh -p 69' someuser@aaa.ccc.xxx.yyy:/home/someuser/ /some/media/BackUp/someuser/

There will be no entry about ssh connection in the server's journal (at least here there is none). Don't get me wrong I am not asking why the log is not showing that user is running rsync. That would be violation of privacy. I am asking why is the ssh keys exchange (which means nothing other then logging into the ssh server just like You would normally) not being shown in the server journal entries. Well at least here its not... LogLevel for sshd is set to VERBOSE. So this is not an issue... Can anyone confirm the issue? What could be the reason? I assume that commands being ran over ssh should still be logged as a ssh key exchange in the system logs?

Please do not hesitate and ask for any information that I could provide to narrow down the problem.

Kind regards.

Andrzej

progandy · 2013-11-11 00:19:26

Maybe try to use -e 'ssh -p 69 -l SshUser'

AndrzejL · 2013-11-11 13:41:51

progandy wrote:

Maybe try to use -e 'ssh -p 69 -l SshUser'

Hi progandy.

Yes, that did it. But then here comes another question... Was the syntax of the command that I have used bad? If not then it should still be logged in the journal right? I mean the command works - its just the system log that chooses to not to take notice of it.

Regards.

Andrzej

progandy · 2013-11-11 18:54:15

It could be that it will login with a different username, namely the one you used you are currently logged in with. Why that doesn't show up in the journal I don't know. Do you read the journal with root privileges or only as a user?

AndrzejL · 2013-12-25 04:29:23

Hi progandy.

I found a possible solution.

su

systemctl enable rsyncd

systemctl start rsyncd

This way journalctl displays info about ssh authentication when rsync is being started.

Also You can add this line:

log file = /var/log/rsync.log

in the

/etc/rsyncd.conf

so it looks like this:

uid = nobody
gid = nobody
use chroot = no
max connections = 4
syslog facility = local5
pid file = /run/rsyncd.pid
log file = /var/log/rsync.log
[ftp]
path = /srv/ftp
comment = ftp area

systemctl restart rsyncd

but this only shows the rsync debug messages like start and stop:

tail -f /var/log/rsync.log
2013/12/25 04:23:50 [30230] rsyncd version 3.1.0 starting, listening on port 873

and You get the same info while tailing journal files so...

Cheers.

Andrzej

Arch Linux

#1 2013-11-10 22:57:06

Why is rsync over ssh is not being shown in journalctl entries?

#2 2013-11-11 00:19:26

Re: Why is rsync over ssh is not being shown in journalctl entries?

#3 2013-11-11 13:41:51

Re: Why is rsync over ssh is not being shown in journalctl entries?

#4 2013-11-11 18:54:15

Re: Why is rsync over ssh is not being shown in journalctl entries?

#5 2013-12-25 04:29:23

Re: Why is rsync over ssh is not being shown in journalctl entries?

Board footer