On Dec 12, 2023, at 01:34, Dave Close <dave(a)compata.com> wrote:
So I spent the last 30 minutes or so trying to find a detailed
description of the content of /var/log/secure. Sure, I know the purpose
of the file and most of the messages are self-explanatory. But some
of the message content is not. I was surprised that multiple search
engines were unable to find anything beyond the obvious ("Keep
authentication logs for both successful ..."). Doesn't Fedora's
documentation anywhere describe this file in some detail?
What gets logged to that file is defined in your /etc/rsyslog.conf. I believe by default,
it’s any syslog entries with the “authpriv” facility is sent to /var/log/secure.
It’s up to each service to define the facility, there’s no dictionary of log entries you
can look up. Heck, you can run “logger -p authpriv.warn HelloWorld” and it should show up
in the secure log.
For example, given the message,
Accepted publickey for ... from ... port ... ssh2: RSA
SHA256:QSyKp5SJ8gJFcYtbtb9SQ1axtqSg7fEoQBiZf3kPXgU
what is the meaning of the RSA value listed? Is it a "fingerprint"?
How can I compare it to the various keys on my system?
Most likely part of OpenSSH’s documentation.
--
Jonathan Billings