ssh logfiles

From: "Maulis Adam" <maulis@xxxxxxxxxxxxxx>
Newsgroups: comp.os.vms
Subject: Re: SSH bug report AXPVMS 8.3 TCPIP V5.6-9ECO3
Message-ID: <HD$m3gUdFqRw@ludens>
Date: Thu, 19 Feb 2009 14:57:04 +0100
Organization: Eotvos University, Budapest, Hungary

JF Mezei <jfmezei.spamnot@xxxxxxxxxxxxx> writes:
Maulis Adam wrote:
I had to modified tcpip$ssh_run.com to produce an single concatenated
log file preserving the logs of last 30 days (local sec. policy enforces this).

Could you elaborate on how you achieved this ? I'd like a similar
behaviour for the SMTP receiver so that a log file could be kep.


here.
1) we have a SYS$LOG clusterwide rooted logical, and a sys$log:[ssh]
directory with the following security profile:
SSH.DIR;1 [TCPIP$AUX,TCPIP$SSH] (RWE,RWE,RE,E)
(correct owner is required)

2) we have an regural maintenance server (cron like) and here a
log maintenance script:
------------------------------
$ if f$search("sys$log:[ssh]sshd*.*;*") .eqs. ""
$ then
$ request /to=oper4 " -I- sshd logfiles not found, not purged"
$ exit
$ endif
$ delete sys$log:[ssh]tmp_*.*;* /before="-12-02:00" /created 'logqualifier'
$ create sys$log:[ssh]sshd_'f$getsyi("NODENAME")'.log -
/fdl=sys$log:[ssh]log.fdl
$ request /to:oper4 " -S- sshd logfiles purged"
-------------------------------

3) $ type sys$log:[ssh]log.fdl
FILE
BEST_TRY_CONTIGUOUS no
CLUSTER_SIZE 16
CONTIGUOUS no
ORGANIZATION sequential
RECORD
BLOCK_SPAN yes
CARRIAGE_CONTROL carriage_return
FORMAT stream_lf
SIZE 0

4) sys$system:tcpip$ssh_run.com
(part of)

$ logfile = "sys$log:[ssh]sshd_" + f$getsyi("NODENAME") + ".log"
$ sshd := $'f$edit("sys$system:tcpip$ssh_sshd2.exe","upcase")' x
$ fname = "sys$log:[ssh]tmp_" + f$getjpi("","PID") + "_" + f$extr(12,20,f$uniq()) + ".log" x
$ set noon x
$ define /user sys$error 'fname' x
$ sshd 'params' x
$ status = $STATUS x
$ if .not. status x
$ then x
$ open/append of 'fname' x
$ write of "''f$time()' sshd exit status: ''status'" x
$ close of x
$ endif x
$ append /new_version 'fname' 'logfile' x
$ sts1=$status x
$ if sts1 x
$ then x
$ delete 'fname';* x
$ sts2= $status x
$ else x
$ wait 0:0:0.2 x
$ append /new_version 'fname' 'logfile' x
$ sts3 = $status x
$ if sts3 then delete 'fname';* x
$ endif x
$ if f$sea(fname) .nes. "" then request/to=oper3 "sshd logappend error: sts=''sts1' ''sts2' ''sts3' fname=''fname'" x
$
-----------------------------------

hth,
Adam Maulis
.

Relevant Pages