Does anybody know how to get a list of connected users via dropbear (w/who commands missing), or at least have dropbear logging sessions including the IP address trying to connect/connected?
What you listed is already logged by default in OpenWrt.
1 Like
Nope... I cannot see anything at all logged regarding dropbear sessions, everything else I need is logged. I am logging through an external log server (linux server) on UDP port 514.
Not sure what this means.
- Are you missing logs?
- How did you setup remote logging?
logread | grep 'authpriv.info dropbear'
The data is logged.
Tue Feb 11 18:12:31 2025 authpriv.info dropbear[20214]: Child connection from xxx.xxx.xxx.xxx:43078
Tue Feb 11 18:13:09 2025 authpriv.info dropbear[20214]: Exit (root) from <xxx.xxx.xxx.xxx:43078>: Disconnect received
Tue Feb 11 18:13:11 2025 authpriv.info dropbear[20305]: Child connection from xxx.xxx.xxx.xxx:42310
1 Like
Luci System->Logging
I enter the IP address of my log server in "External system log server"
However dropbear does not log anything using the external log server.
I have just found out that if I configure also "Write system log to file" as "/var/log/system.log" logs are duplicated there and dropbear also logs to the file, but not to the log server, which is annoying because logs sent to the server are archived whilst logs on the router are lost on reboot.
Works for me on a Netgear WNDR3700v4 using release 24.10.0 (freshly installed and configured from scratch)
I log externally to a Raspberry PI on the LAN and it receives the dropbear lines okay.
pi@rPi3b:/var/log $ grep dropbear auth.log
...
Feb 12 14:45:16 OpenWrt24 dropbear[17202]: Child connection from 5.161.xx.x:54218
Feb 12 14:45:16 OpenWrt24 dropbear[17202]: Exit before auth from <5.161.xx.x:54218>: Exited normally
Feb 12 14:45:43 OpenWrt24 dropbear[17203]: Child connection from 192.168.203.167:50349
Feb 12 14:45:51 OpenWrt24 dropbear[17203]: Password auth succeeded for 'root' from 192.168.203.167:50349
Feb 12 14:47:52 OpenWrt24 dropbear[17203]: Exit (root) from <192.168.203.167:50349>: Exited normally
1 Like