3

I'm going to setup a Linux console box for login to Cisco devices via ssh only from that Linux machine. How I can setup ssh client on Linux to log all commands applied to Cisco devices?

kasperd
  • 30,455
  • 17
  • 76
  • 124
perun_
  • 31
  • 1
  • 3

3 Answers3

2

You can use the script command to log all the terminal output, which under normal circumstances include all the typed commands.

An invocation could look like this if you want to append to a single file:

script -a -f -c 'ssh cisco.example.com' /var/local/log/ssh-cisco.log

Or like this if you want separate files per invocation:

script -f -c 'ssh cisco.example.com' "/var/local/log/ssh-cisco-$(date date +%Y-%m-%d_%H:%M:%S.%N).$$.log"

If the user were required to type those commands themselves, they would of course be too lazy to do all that extra typing to enable logging. And writing the entire thing in a shell script might not be good enough for you either, since I am assuming you don't want the users to be able to bypass the logging.

So you want to avoid the users having access to bypass the logging, and you don't want them to have write access to the directory containing the logs either.

You could setup a separate group which has read access to the ssh key and write access to the log directory. Then you can wrap the script command in a set-group-id executable or sudo.

kasperd
  • 30,455
  • 17
  • 76
  • 124
0

I found a solution with "| tee -a logfile" Is there any other solution for that? I need only commands in logfile not all output, if that is possible.

perun_
  • 31
  • 1
  • 3
  • The ssh client does not know about commands on the remote system. All it knows is a stream of input (key presses) and a stream of output. Using `tee` for the input would cause `ssh` to stop treating it as a terminal connection, and would also cause keys to be logged when not echoed, so passwords could end up in the log. – kasperd Apr 18 '16 at 09:55
0

Correct me if I'm wrong, but AFAIK, even CISCO devices have a .bash_history file. When you log in, all the commands are saved there in timeline order. Therefore I don't see the use of asking the SSH client to save every command you type.

Bert
  • 1,028
  • 1
  • 16
  • 33