Log commands executed over SSH

Question

I would like to log all commands executed over SSH.

Say,

ssh something@server.com COMMAND

I want to log "COMMAND" on server.com

I did search extensively but could not find anything.

There is one more similar question but I don't think there is a solution over there.

How to log "remote execution over SSH"

I can get a live view with

pstree -p | grep ssh

I did try Snoopy, auditd, and sudosh but could not log those commands over SSH.

There is a http://freecode.com/projects/shwatchr, but I am not able to download the script to test.

Is there any other way to get this done?

score 5 · Answer 1 · answered Dec 06 '13 at 13:12

5

i did a test using this option in my server suse lab and it work, but maybe there is better way.

ForceCommand logger -p user.notice "$SSH_ORIGINAL_COMMAND"

answered Dec 06 '13 at 13:12

c4f4t0r

5,301
3
31
42

1

This does log the command sent but does not execute it on the remote system. – Michael McGarrah May 02 '18 at 21:58

score 4 · Answer 2 · answered Dec 10 '13 at 08:29

4

Instead of focusing on SSH, take a step back and consider using auditd. I'm assuming that what you really want is to track the users, not tracking what is done from SSH as opposed to with other types of login.

man auditctl should give you a starting point.

answered Dec 10 '13 at 08:29

Jenny D

27,780
21
75
114

2

Nice hint, but for me too abstract. How to use `auditctl` to log ssh commands? – guettli Aug 26 '19 at 10:31

score 2 · Answer 3 · answered Dec 10 '13 at 05:32

I have found a way to do this. There is a perl script written by John M. Simpson(https://www.jms1.net/).

All you have to do is add

command="#{path to log-session}"

before each key in your ~/.ssh/authorized_keys

It works only if you have a password-less ssh, but this does solve my purpose to an extent.

http://www.jms1.net/log-session

score 2 · Answer 4 · answered Apr 24 '18 at 10:47

2

Would Snoopy help you out with this? “Log every executed command to syslog (a.k.a. Snoopy Logger).”

https://github.com/a2o/snoopy

answered Apr 24 '18 at 10:47

Ben Lavender

284
1
5

score 1 · Answer 5 · answered Apr 24 '18 at 09:38

In my case I had the exact same requirement. The only caveat with this method is that I'm not sure how to make it work if you don't make use of ssh keys. I made a short bash script to log the command before executing it:

#!/bin/bash
echo "$(date -Is) ${SSH_ORIGINAL_COMMAND}" >> ~/sshcommands.log
sh "${SSH_ORIGINAL_COMMAND}"

I saved this command to ~/bin/log-commands then made it executable (chmod +x ~/bin/log-commands).

In the authorized_keys file, I added the command= parameter to the line belonging to the SSH key I wanted to have logs for, so it would be forced to run the log-commands script:

command="/home/tricky/bin/log-commands" ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQ......6J0C1 tricky@tricky-testing.mydomain

If someone is aware of the logging but doesn't want you to see the commands, they can simply go into an interactive session. As you mentioned, you already tried snoopy, which will do that for you. Popular alternatives I haven't tried are rootsh, sudosh, and log-user-session.

score 0 · Answer 6 · answered Apr 19 '23 at 02:43

Have you tried SSHLog https://github.com/sshlog/agent/ (I'm a contributor)? This will log each COMMAND to a log file, for example:

2023-04-09 15:15:05: command_start          (653204) jdoe executed /usr/bin/whoami
2023-04-09 15:15:05: command_finish         (653204) jdoe execute complete (exit code: 0) /usr/bin/whoami

In this example, if a user SSH into your server and types "whoami" it would generate this log data.

Log commands executed over SSH

6 Answers6

Linked