While all the other PAM-aware apps (ie, login, su etc.) log everything about user logins and logouts, I've noticed that sshd doesn't. It only logs something like "password accepted for user xxyyzz", and that message also seem not to come from PAM. Furthermore, logouts from a remote ssh session are never logged. For login or su, the start and end of a session look something like:
Sep 23 15:28:25 statler login(pam_unix)[194]: session opened for user davide by LOGIN(uid=0) Sep 23 15:28:25 statler login[195]: `davide' logged in on `tty2' ..... Sep 23 17:28:27 statler login(pam_unix)[194]: session closed for user davide For sshd, there is only this: Sep 23 09:47:25 statler sshd[11963]: Accepted password for davide from scooter port 33049 ssh2 and no evidence for the logout. Is this all normal? -- [EMAIL PROTECTED] mailing list
