Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is there any way to listen in on port 22, on my server, to see if anyone submitted any commands while ssh'd into my server? Or rather, output what commands were submitted (and the ip address of who connected), almost like a 'live' log?

share|improve this question

migrated from stackoverflow.com Apr 29 '11 at 0:00

This question came from our site for professional and enthusiast programmers.

5 Answers 5

Turn up the logging on your SSH daemon.

 LogLevel
         Gives the verbosity level that is used when logging messages from
         sshd.  The possible values are: QUIET, FATAL, ERROR, INFO, VER-
         BOSE, DEBUG, DEBUG1, DEBUG2 and DEBUG3.  The default is INFO.
         DEBUG and DEBUG1 are equivalent.  DEBUG2 and DEBUG3 each specify
         higher levels of debugging output.  Logging with a DEBUG level
         violates the privacy of users and is not recommended.
share|improve this answer
    
Actually, logging with DEBUG and higher levels outputs quite a bit of information but I haven't ever seen it logging the commands run. Are you sure about this? –  Eduardo Ivanec Apr 29 '11 at 5:17

You can use process accounting to keep a detailed log of commands run on your server.

On Debian:

apt-get install acct

Then use lastcomm to see who ran what at what time. lastcomm --help lists several ways to get information, including filtering by user, command or tty.

You can use last to figure out which virtual terminal (for example pts/9) was assigned to the ssh session you're interested in. Then, continuing with the example, run:

lastcomm pts/9
share|improve this answer

The auth.log file should have a history of SSH logins (enabled by default).

If you're running SSH on port 22 you should have extreme password requirements or use SSH Keys and disable password authentication.

share|improve this answer
strace -o trace -f -p PID_OF_SSH # will give lots of output and very low level 
share|improve this answer
    
This must be run as root or the user who owns the SSH process on Linux. –  user314104 Mar 11 '13 at 2:05

Unlikely. If you have ssh running on port 22 (as it's intended), then the communications are encrypted.

w or who or last will let you see who is connected.

If they're logging their commands to a history, then you could inspect their history files.

Also, this should be on Super User.

share|improve this answer
    
So I couldn't see who is connected and what commands they are submitting? On my server? –  mcwillig Apr 28 '11 at 23:54
    
Ah, my mistake, but my question still stands –  mcwillig Apr 28 '11 at 23:55
    
Not by listening on port 22, no. –  Andy Lester Apr 28 '11 at 23:55
    
You can see who's connected. See: w or who or last. If they're logging their commands to a history, then you could inspect their history files. –  entropo Apr 28 '11 at 23:56
    
You say not by listening, so is there another way of doing this? –  mcwillig Apr 28 '11 at 23:57

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.