Technical Notes

Enabling SFTP Logging in Reflection for Secure IT UNIX Server 6.1
Technical Note 1937
Last Reviewed 09-Jun-2005
Applies To
Reflection for Secure IT UNIX Server version 6.1
Summary

This technical note describes how to enable SFTP logging in Reflection for Secure IT UNIX Server 6.1.

Note the following:

• Details provided in this technical note are specific to a host running the Solaris operating system. File locations and command syntax may be different on other host operating systems.
• Beginning with version 6.0, the F-Secure ssh product line has a new name Reflection for Secure IT.

Enabling SFTP Logging

Follow these steps to enable SFTP logging in Reflection or F-Secure SSH for UNIX.

Note: Depending on the number of users and number of files uploaded or downloaded, the log file may fill up quickly.

1. Open the sshd2_config file in a text editor. By default, this file is located in the /etc/ssh2 directory.
2. Uncomment (remove the # symbol from the beginning of the line) the following line:

3. Save the file.
4. Open the syslog.conf file in a text editor. By default, this file is located in the /etc directory.
5. Add the following two lines:

Value	Functions Logged
notice	This value logs when the SFTP server starts and stops, directory listings, file deletions, file uploads and downloads, and when files are renamed.
info	This value logs the same functions as above, plus server responses.

6. Issue the following commands to create the file where the log information will be stored:

7. Issue the following commands to stop the daemons:

8. Issue the following commands to start the daemons:

Logging starts once the daemons are restarted.

Disabling SFTP Logging

Follow these steps to disable SFTP logging.

1. Open the sshd2_config file in a text editor. By default, this file is located in the /etc/ssh2 directory.
2. Comment out (insert a # at the beginning of the line) the following line:

3. Save the file.
4. Open the syslog.conf file in a text editor. By default, this file is located in the /etc directory.
5. Remove the following two lines:

6. Save the file.
7. At the command prompt, enter the following commands to stop the log and ssh daemons:

8. Once the ssh daemons have been stopped, enter the following commands to restart the daemons:

9. If you want to delete the log, delete the file /var/adm/sftplog.

Related Technical Notes

2291	Using Debug Mode to Troubleshoot Reflection for Secure IT Windows Server