Listening on port 22

Question

Is there any way to listen in on port 22, on my server, to see if anyone submitted any commands while ssh'd into my server? Or rather, output what commands were submitted (and the ip address of who connected), almost like a 'live' log?

Answer 1

The auth.log file should have a history of SSH logins (enabled by default).

If you're running SSH on port 22 you should have extreme password requirements or use SSH Keys and disable password authentication.

Answer 2

Unlikely. If you have ssh running on port 22 (as it's intended), then the communications are encrypted.

w or who or last will let you see who is connected.

If they're logging their commands to a history, then you could inspect their history files.

Also, this should be on Super User.

Answer 3

strace -o trace -f -p PID_OF_SSH # will give lots of output and very low level 

Answer 4

You can use process accounting to keep a detailed log of commands run on your server.

On Debian:

apt-get install acct

Then use lastcomm to see who ran what at what time. lastcomm --help lists several ways to get information, including filtering by user, command or tty.

You can use last to figure out which virtual terminal (for example pts/9) was assigned to the ssh session you're interested in. Then, continuing with the example, run:

lastcomm pts/9

Answer 5

Turn up the logging on your SSH daemon.

 LogLevel
         Gives the verbosity level that is used when logging messages from
         sshd.  The possible values are: QUIET, FATAL, ERROR, INFO, VER-
         BOSE, DEBUG, DEBUG1, DEBUG2 and DEBUG3.  The default is INFO.
         DEBUG and DEBUG1 are equivalent.  DEBUG2 and DEBUG3 each specify
         higher levels of debugging output.  Logging with a DEBUG level
         violates the privacy of users and is not recommended.