Forum Discussion

AbuAhmad's avatar
AbuAhmad
Icon for Nimbostratus rankNimbostratus
Mar 26, 2014

Logging client IP address for SSH attempts

I have a request to log client IP address for SSH port 22 connections and attempts. The issue they have that they see numerous logins attempts with Root, guest, admin user IDs and wrong password, any...
application delivery
BIG-IP DNS
LTM
management
AbuAhmad's avatar
AbuAhmad
Icon for Nimbostratus rankNimbostratus
Mar 27, 2014

Thank you Kevin for your help, my knowledge with iRules is very little. Here is what I need to do: I have a farm that has http, https, and SSH virtual servers. (X-Forward-For can work with http/https but not SSH). 1- I need to log all clients IPs that tries to access those VS to another server so it will not over loading the local drive on the BIG-IP. 2- If the IP of the remote server is 192.168.xx.xx how the iRule will look like, I tried this!! >> when CLIENT_ACCEPTED {

 

log local0 192.168.xx.xx "Request for service at port [TCP::local_port] from [IP::client_addr]" }

 

3- On the remote server, where can the logs be found? 4- Do I need any tools to reed the logs or it will be in a txt file? If a tool needed can you suggest one please. Thanks again Kevin.