Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Possible Duplicate:
How do I log every command executed by a user?

How can I log SSH activity on 10.04 Ubuntu Server? This includes all commands he issued and output he got.

share|improve this question

marked as duplicate by Bart De Vos, Iain Feb 22 '12 at 12:23

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

check this out… – neolix Feb 22 '12 at 7:03
Or even better, see this.… – Zoredache Feb 22 '12 at 8:13

2 options I see for you:

  1. Use rootsh. Rootsh is a wrapper for shells which logs all echoed keystrokes and terminal output to a file and/or to syslog. It's main purpose is the auditing of users who need a shell with root privileges. They start rootsh through the sudo mechanism. This wil not log everything, only what they perform in a root shell.

  2. Use screen. You can force users in a screen-session when they log on to your server, you can then use screen to log everything they type.

But the bottom-line is, if you don't trust a user, don't allow them on your system. No system is bulletproof.

share|improve this answer
I guess rootsh is not a good option since they may or may not do actions with root privileges, but I need to know about all actions. For the screen I am not sure how to force and will they be aware easily that they are in screen? If you could give some hints on how to force ssh login to enter screen, then I might try experience. Actually it's not about breaking something on my system, just monitoring the job is done properly or not. It's not a security issue, just supervising. – Michael Feb 22 '12 at 8:09
The, you should probably have a look at this: – Bart De Vos Feb 22 '12 at 8:24

Possible screen as shell?

But its hard for be sure, that user cant hack that.

share|improve this answer
Not possible. I just have couple users, which will be doing some job in their home dirs through ssh and I want to watch them with minimal efforts. – Michael Feb 22 '12 at 7:18
home dirs? couple users? who cares. screen just save log. – Korjavin Ivan Feb 22 '12 at 7:21
I can't force them to use screen and it should not be noticeable that I am going to watch them. – Michael Feb 22 '12 at 7:26


LogLevel Debug3

to /etc/ssh/sshd_config and restart.

Note: "Logging with a DEBUG level violates the privacy of users and is not recommended."

share|improve this answer
)) this gives me really debug information such like debug3: Wrote 52 byte for a total of 3931. This is not what I want. Something human readable. – Michael Feb 22 '12 at 7:52
Try LogLevel Debug – dmourati Feb 22 '12 at 22:33

Not the answer you're looking for? Browse other questions tagged or ask your own question.