topic Re: SSH logging? in Firewall and Security Management https://community.checkpoint.com/t5/Firewall-and-Security-Management/SSH-logging/m-p/248111#M48469 <P>I was looking at the R82 smart event I have in my lab, but did not see anything specific for ssh logins.</P> <P>Andy</P> Mon, 05 May 2025 14:20:33 GMT the_rock 2025-05-05T14:20:33Z SSH logging? https://community.checkpoint.com/t5/Firewall-and-Security-Management/SSH-logging/m-p/248104#M48465 <P>Good morning!</P> <P>Running R81.20</P> <P>&nbsp;</P> <P>What is the best practice for monitoring and logging SSH sessions to our Security Gateways / SMS?</P> <P>I'd like to be able to see a daily report for all sessions and what was done during the session if possible.</P> <P>&nbsp;</P> <P>Thank you!</P> Mon, 05 May 2025 13:19:46 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/SSH-logging/m-p/248104#M48465 Joe_Kanaszka 2025-05-05T13:19:46Z Re: SSH logging? https://community.checkpoint.com/t5/Firewall-and-Security-Management/SSH-logging/m-p/248106#M48466 <P>Hi&nbsp;<a href="https://community.checkpoint.com/t5/user/viewprofilepage/user-id/19186">@Joe_Kanaszka</a>&nbsp;</P> <P>I think you should use <A href="https://delinea.com/products/secret-server/features/session-recording" target="_self">3rd party solution for this</A>.</P> <P>Akos</P> Mon, 05 May 2025 13:38:58 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/SSH-logging/m-p/248106#M48466 AkosBakos 2025-05-05T13:38:58Z Re: SSH logging? https://community.checkpoint.com/t5/Firewall-and-Security-Management/SSH-logging/m-p/248111#M48469 <P>I was looking at the R82 smart event I have in my lab, but did not see anything specific for ssh logins.</P> <P>Andy</P> Mon, 05 May 2025 14:20:33 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/SSH-logging/m-p/248111#M48469 the_rock 2025-05-05T14:20:33Z Re: SSH logging? https://community.checkpoint.com/t5/Firewall-and-Security-Management/SSH-logging/m-p/248112#M48470 <P>Maybe the parsing the /var/log/messages -&gt; the logins are logged.</P> Mon, 05 May 2025 14:24:02 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/SSH-logging/m-p/248112#M48470 AkosBakos 2025-05-05T14:24:02Z Re: SSH logging? https://community.checkpoint.com/t5/Firewall-and-Security-Management/SSH-logging/m-p/248114#M48471 <P>Dashboard Audit Logs:</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Screenshot 2025-05-05 163024.png" style="width: 999px;"><img src="https://community.checkpoint.com/t5/image/serverpage/image-id/30395iFCE803EEFFA95FD9/image-size/large?v=v2&amp;px=999" role="button" title="Screenshot 2025-05-05 163024.png" alt="Screenshot 2025-05-05 163024.png" /></span></P> <P>I connected with WinSCP first and then started Putty (shown log entry).</P> <P>WHat was done is visible in Legacy SVTracker:</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Screenshot 2025-05-05 164045.png" style="width: 999px;"><img src="https://community.checkpoint.com/t5/image/serverpage/image-id/30396i14045316A9808C70/image-size/large?v=v2&amp;px=999" role="button" title="Screenshot 2025-05-05 164045.png" alt="Screenshot 2025-05-05 164045.png" /></span></P> Mon, 05 May 2025 14:41:56 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/SSH-logging/m-p/248114#M48471 G_W_Albrecht 2025-05-05T14:41:56Z Re: SSH logging? https://community.checkpoint.com/t5/Firewall-and-Security-Management/SSH-logging/m-p/248120#M48472 <P>That is indeed super useful, though wondering if there is a report for it in smart event?</P> <P>Andy</P> Mon, 05 May 2025 15:38:02 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/SSH-logging/m-p/248120#M48472 the_rock 2025-05-05T15:38:02Z Re: SSH logging? https://community.checkpoint.com/t5/Firewall-and-Security-Management/SSH-logging/m-p/248124#M48473 <P>Thank you for this!&nbsp;&nbsp;</P> Mon, 05 May 2025 18:33:57 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/SSH-logging/m-p/248124#M48473 Joe_Kanaszka 2025-05-05T18:33:57Z Re: SSH logging? https://community.checkpoint.com/t5/Firewall-and-Security-Management/SSH-logging/m-p/248125#M48474 <P>Hey brother,</P> <P>Hope what I attached helps. Its via smartview.</P> <P>Andy</P> Mon, 05 May 2025 18:41:12 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/SSH-logging/m-p/248125#M48474 the_rock 2025-05-05T18:41:12Z Re: SSH logging? https://community.checkpoint.com/t5/Firewall-and-Security-Management/SSH-logging/m-p/248127#M48476 <P>Thank both you guys!</P> Mon, 05 May 2025 18:43:12 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/SSH-logging/m-p/248127#M48476 Joe_Kanaszka 2025-05-05T18:43:12Z Re: SSH logging? https://community.checkpoint.com/t5/Firewall-and-Security-Management/SSH-logging/m-p/248128#M48477 <P>Its not perfect, but better than nothing lol</P> <P>Andy</P> Mon, 05 May 2025 18:44:02 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/SSH-logging/m-p/248128#M48477 the_rock 2025-05-05T18:44:02Z Re: SSH logging? https://community.checkpoint.com/t5/Firewall-and-Security-Management/SSH-logging/m-p/248129#M48478 <P>I forgot to ask you how you enter Legacy SmartView Tracker from Smart Log?</P> Mon, 05 May 2025 19:18:33 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/SSH-logging/m-p/248129#M48478 Joe_Kanaszka 2025-05-05T19:18:33Z Re: SSH logging? https://community.checkpoint.com/t5/Firewall-and-Security-Management/SSH-logging/m-p/248133#M48480 Mon, 05 May 2025 19:56:35 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/SSH-logging/m-p/248133#M48480 the_rock 2025-05-05T19:56:35Z