Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a closed source program which calls server over SSH and executes a set of commands.

Could you tell me how can I log all commands?

My server is under Ubuntu.

share|improve this question
    
maybe this can help you serverfault.com/questions/559658/log-commands-executed-over-ssh/… –  c4f4t0r Dec 26 '13 at 20:34
    
serverfault.com/questions/470755/… a more detailed answer explaining how to use auditd –  fuero Dec 26 '13 at 22:43
add comment

3 Answers

Snoopy can be used to log all commands ran on a system. Logs will be sent to syslog.

share|improve this answer
add comment

Without knowing exactly how it's doing it's thing, there's no one answer that I can give. However, a few possibilities:

  • It uses keys for authentication, and runs a command it passes at login: This is easy. Add a command= to the entry in ~/.ssh/authorized_keys that calls a script that logs the command it runs, and then just execs the command. Transparent, simple.
  • It uses keys for authentication, runs a shell, and stuffs commands down the shell: Harder, but still straightforward. Again, command= in ~/.ssh/authorized_keys to run a shell of your choosing, which could be something like sudoshell or something else that logs all commands (for super bonus trickery, you could even use script for full replayability).
  • It uses passwords: No command= trickery allowed here, you're going to have to go the whole hog and use something like snoopy to log everything that happens -- but unless this program is the only thing using SSH, you'll likely end up with a lot of logs.
share|improve this answer
    
the program can use key based auth. do you have script sample to log calls? thank you –  user349302 Jul 5 '11 at 0:11
add comment

If the close source program allows you to edit remote SSH parameters or you can put the commands into a shell script, you can wrap your execution around the "script" command on the remote server like this:

ssh 192.168.15.200 'script ps.log -c "ps -ef"'

In this case, the output of ps -ef is saved into the file ps.log

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.