We have a policy of logging all SSH session activity for CYA purposes with our clients. With PuTTY under windows this is trivial, as we can log each session to a file using PuTTY's built-in logging facility. But when working from Linux workstations, it's not quite as simple.
Note that server-side logging, while important for other reasons, is not part of what we're doing here. These session logs are for our own reference alone.
So far we've looked at the following options:
- Logging of ALL terminal activity using script triggered either in .bash_profile or as wrapper to the login shell (far from ideal)
- Replacing /usr/bin/ssh with a wrapper that starts a per-session log (better, but might have side-effects)
- Forcing all employees to use PuTTY for Linux instead of ssh from the command line (also very much not ideal)
Logging needs to be totally automatic, and ideally we want to be able to separate out different sessions into individual files.