logging SFTP access in Debian 9 Stretch
To start logging SFTP access in Debian 9 Stretch all you need to to is to edit a config file and restart a service.
First make sure that the sshd service is currently running if you are not remotely accessing the machine to begin with by using the following command:
systemctl status sshd
Under “# override default of no subsystems” within the config file add the following line under it.
Subsystem sftp /usr/libexec/openssh/sftp-server -l INFO
Then restart the sshd service with the following command:
systemctl restart sshd
Next connect via SFTP and then check the log file and look for your traffic. The log file should be located at: