auditing ssh and Xwindows

[Jason Mackanick_4]

I am trying to use a trusted system to audit ssh logins. I found that I had to set UseLogin to yes in the sshd_config. When I do this, the X11 port forwarding does not work with ssh anymore. Any suggestions to fix this?

[Kasper Hedensted]

Hi Jason,

Yes X11 port forwarding is disabled when UseLogin is set to yes. From sshd_config manpage:

X11Forwarding will be disabled because login(1) does not know how to handle xauth(1) cookies

I haven't tried this but take a look at this site:
http://www.mayoxide.com/audenable/

Cheers,
Kasper

[Jason Mackanick_4]

Are there any other ways to have the trusted auditing work correctly without utilizing the UseLogin feature?

[Kasper Hedensted]

I am not aware of this (I haven't used auditing that much)

But you can set ssh to log logins to syslog (This might be default)