How to record ssh session and email them periodically?

Question

Is there anyway to record all remote SSH client's activity on a linux machine and email them on a periodic basis?

Answer 1

It depends a bit on your actual use case. If your users can't be trusted you should consider revoking their access privileges.

A basic trick is to look at the .bash_history but that's completely unreliable.

A classical tool is script which can be used to make a transcript of an interactive session, every keystroke, each backspace and the output of commands.

Much more sound is proper auditing such as with auditd .

If you're only interest is privileged sudo sessions set loginput and logoutput investigate sudoreplay

Answer 2

First you'll probably want all SSH sessions to have PROMPT_COMMAND='history -a' so that every command is persisted to history. Then you'll probably want a cron job to tail the last $X of lines of bash history and pipe it to mail.

It's awful, and I'm a worse person for having typed all that. I will now go wash my keyboard out with soap.

_{This is not foolproof or in any way an audit tool. It can be subverted, tampered with, and modified in many ways. YMMV. IANAL.}