Command last does not show logins through sFTP, is there something similar or any logs?

The default configuration of syslogd sends all log messages related to authentication to /var/log/auth.log, which will include openssh-server's log messages.


The last commands reads from /var/log/wtmp and its bad cousin /var/log/btmp, which according to man (man wtmp) are the login records.

Not all processes use this facility, so there may be other users logged to the system.

In the sftp case, I think that sshd does not consider scp or sftp as interactive sessions.

This was also discussed at https://unix.stackexchange.com/questions/20070/user-logged-in-by-sftp-does-not-show-up-in-w .


Add pam_lastlog.so module at the beginning of session section in /etc/pam.d/sshd file as shown below.

# vi /etc/pam.d/sshd 
<snip..>
session    required     pam_lastlog.so
session    required     pam_selinux.so close
session    required     pam_loginuid.so
<snip..>

Ensure the option UsePAM is enabled in /etc/ssh/sshd_config. If not, make the changes and restart sshd service.

# vi /etc/ssh/sshd_config 
<snip..>
#UsePAM no
UsePAM yes
<snip..>

# service sshd restart