Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

If a user execute commands remotely over ssh :

[user@remote ~] $ ssh USERNAME@SERVER COMMANDS

How the SERVER administrator can log those COMMANDS executed in a "not a tty" session ?

Also when a user invokes a new shell(running /bin/bash from existing bash shell), commands executed in this new shell are not listed in user's bash history; How to log those commands ?

share|improve this question
    
possible duplicate of Live view of Linux shell commands executed by another user? –  mailq Sep 25 '11 at 12:00
    
@mailq I don`t think so. This question here is not aimed at doing this live. –  Nils Jan 12 '12 at 21:22

2 Answers 2

Just install GNU Accounting (acct for Debian/Ubuntu or psacct for RedHat/CentOS) and use the command lastcomm to trace all the commands executed by all your users.

share|improve this answer

SSH used to have an option called "fascist logging" this option seems to have vanished - that option could do keystroke logging.

Now even raising the logging-level to DEBUG3 for SSHD will NOT reveal the commands.

But perhaps the answer to your second question will also solve the first one. The mechanism of bash history appending has been described in the accepted answer to this question.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.