Monitor an incoming SSH session in real time

Question

Is there any linux software to monitor an incoming ssh session. At a previous job I was told that if you ever needed support from Red Hat for example you could have them SSH into your machine and you could watch what they were doing.

I'm in a similar situation where I want to ssh into my friends machine to help him out but I want him to be able to watch what I'm doing for educational purposes and to ensure I don't do anything malicious.

Any suggestions?

Thanks

Answer 1

GNU Screen has this ability, you could allow a specific shell user to only operate through screen.

https://www.linux.com/learn/tutorials/442418-using-screen-for-remote-interaction

Answer 2

For a similar thing: http://serverfault.com/questions/8851/live-view-of-linux-shell-commands-executed-by-another-user

Answer 3

You can use script command. Build a line in .login or .profile of the user whose ssh session you want to monitor. When he logs in a script / log is generated of his I/O which gives you commands run and the output of those commands. In real time you can just tail the script and watch what the user does in real time.

Unable to paste a link for your referrance but you can just google on the command " script " and you will get the referrances.

Answer 4

You can use kibitz. Quoting from the man page:

kibitz allows two (or more) people to interact with one shell (or any arbitrary program).

On Fedora, it's included in the expect package.

Answer 5

I use whowatch on my server.

apt-get install whowatch

Answer 6

I think screen is what you're after, but if you don't want to sit there watching, and want to "video" a user's session, you can look at sudo shell.

If you set the user up with this as their shell, you can have a complete recording of everything that occurred, and you can the "replay" it back, and watch it when/if you need to.

The only possible downside to this is that the logs can grow very large, for example if they run a command like find /, you will have all that recorded too - so you'll probably have to pick which accounts to enable it for rather than doing it globally.

As for allowing vendors login access, this is probably perfect, because you have a complete audit trail of everything they did, everything (even backspacing) is recorded and stored for replay.

Answer 7

screen or tmux .

tmux sharing is a little easier.