Managing Auditing

 » Table of Contents

 » Glossary

 » Index

spacerspacerspacer
spacer
spacer
  		 
 

The following sections describe the SSH server auditing functions and the configuration parameters that you can use to modify SSH auditing functions. For more information about the configuration parameters, see Appendix B.

How the Server Performs Auditing

When auditing is enabled for the specified authentication method, the SSH server performs the following functions depending on the type of login and whether the login attempt is successful.

When an interactive login is successful:

  • The login failure count is set to 0.

  • The last interactive login date is updated to the current date and time.

  • If the user's password has expired but the user is not forced to change it before logging in, a warning message is displayed and the pwd_expired flag is not set in the user's SYSUAF record.

  • The user is allowed three failed attempts to log in. If all three attempts fail, the login failure count is incremented by three.

  • If the AccountingAuthentications keyword includes the current authentication method, the accounting data is updated.

When a remote command execution is successful, no updates are made to the user's SYSUAF record; thus:

  • The login failure count is not changed.

  • The last noninteractive login date is not updated.

If the user's password has expired but the user is not forced to change it before logging in, a warning message is displayed and the pwd_expired flag in the user's SYSUAF record is not set.

When the login or remote command execution fails:

  • The login failure count in the user's SYSUAF record is incremented.

  • If the IntrusionAuthentications keyword includes the current authentication method, the intrusion database is updated with text controlled by the IntrusionIdentSsh and IntrusionIdentMethod keywords in the server configuration file.

  • If the AccountingAuthentications keyword includes the current authentication method, the accounting data is updated.

Auditing Options for the Server Configuration File

You can include the following options in the server configuration file (TCPIP$SSHD_CONFIG.) to control auditing functions.

  • AccountingAuthentications

  • AllowNonvmsLoginWithExpiredPw

  • IntrusionAuthentications

  • IntrusionIdentMethod

  • IntrusionIdentSsh

  • LogfailAuthentications

  • PubkeyPassphraseGuesses

  • UserLoginLimit

Auditing Options for the Client Configuration File

You can include the following options in the client configuration file (TCPIP$SSH_CONFIG.) to control auditing functions.

  • NumberOfHostkeyCopyPrompts

  • NumberOfPasswordVerificationPrompts

  • PubkeyPassphraseGuesses

The configuration parameters are described in Appendix B.



SSH Logical Names
  		 


Managing Account Passwords