Log SSH activity

Question

All, I have an Ubuntu host that accepts SSH connections. How can I log all commands that are run on a specific account that logs in via SSH?

Thanks

score 5 · Answer 1 · answered Mar 14 '12 at 16:37

5

Maybe you can make sshd use a logging shell like rootsh?

answered Mar 14 '12 at 16:37

tohuwawohu

7,502

score 4 · Answer 2 · edited Nov 12 '12 at 12:23

4

You can try with snoopy. After you install it, will logs all input command that calls execve to syslog. you'll only find it in the repos for hardy and precise.

You can install it from here.

edited Nov 12 '12 at 12:23

answered Apr 22 '12 at 12:49

Nextoor

49

score 3 · Answer 3 · answered Mar 13 '12 at 19:51

3

I don't think SSHD logs commands while the user is logged in.

you can check who logged in by checking

/var/log/auth.log

and cross reference it to their history

/home/sshuser/.bash_history

history will have commands local or remote though.

answered Mar 13 '12 at 19:51

Matt Mootz

569

score 1 · Answer 4 · answered Mar 13 '14 at 09:17

1

I have a similar problem and wrote the tool log-user-session which stores all shell output into a root-only accessible session log file. It can be enabled via forced command on sshd_conf or ~/.ssh/authorized keys (see documentation).

answered Mar 13 '14 at 09:17

Konrad Bucheli

36

Log SSH activity

4 Answers4

Linked

Related