Forum Discussion

AbuAhmad's avatar
AbuAhmad
Icon for Nimbostratus rankNimbostratus
Mar 26, 2014

Logging client IP address for SSH attempts

I have a request to log client IP address for SSH port 22 connections and attempts. The issue they have that they see numerous logins attempts with Root, guest, admin user IDs and wrong password, any...
application delivery
BIG-IP DNS
LTM
management
Kevin_Stewart's avatar
Kevin_Stewart
Icon for Employee rankEmployee
Mar 26, 2014

At the very least:

when CLIENT_ACCEPTED {
    log local0. "Request for service at port [TCP::local_port] from [IP::client_addr]"
}

That should log the client source address for any incoming TCP session, but it will not log the usernames/passwords in the SSH sessions.