2

If a user execute commands remotely over ssh :

[user@remote ~] $ ssh USERNAME@SERVER COMMANDS

How the SERVER administrator can log those COMMANDS executed in a "not a tty" session ?

Also when a user invokes a new shell(running /bin/bash from existing bash shell), commands executed in this new shell are not listed in user's bash history; How to log those commands ?

Johnas
  • 21
  • 1
  • 2
  • possible duplicate of [Live view of Linux shell commands executed by another user?](http://serverfault.com/questions/8851/live-view-of-linux-shell-commands-executed-by-another-user) – mailq Sep 25 '11 at 12:00
  • @mailq I don`t think so. This question here is not aimed at doing this live. – Nils Jan 12 '12 at 21:22

3 Answers3

2

Just install GNU Accounting (acct for Debian/Ubuntu or psacct for RedHat/CentOS) and use the command lastcomm to trace all the commands executed by all your users.

bintut
  • 304
  • 1
  • 5
1

SSH used to have an option called "fascist logging" this option seems to have vanished - that option could do keystroke logging.

Now even raising the logging-level to DEBUG3 for SSHD will NOT reveal the commands.

But perhaps the answer to your second question will also solve the first one. The mechanism of bash history appending has been described in the accepted answer to this question.

Community
  • 1
Nils
  • 7,695
  • 3
  • 34
  • 73
0

You can log these commands with SSHLog https://github.com/sshlog/agent/ (I'm a contributor).

The app would catch all commands (including piping through bash as you cite in your question). It will also record commands that are typed via TTY and ones that are not sent via TTY. Here's an example where a user ssh into the server and runs:

bash
whoami
exit

The log file would show:

2023-04-18 16:47:59 command_start          (2554513) jdoe executed /usr/bin/bash
2023-04-18 16:48:00 command_start          (2554513) jdoe executed /usr/bin/whoami
2023-04-18 16:48:00 command_finish         (2554513) jdoe execute complete (exit code: 0) /usr/bin/whoami
2023-04-18 16:48:10 command_finish         (2554513) jdoe execute complete (exit code: 0) /usr/bin/bash

Notice the bash terminal opens, 'whoami' is run inside that new terminal, and when bash is finally closed it reports the completion of the command.

Derrick Johnson
  • 141
  • 5