Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

One of our suppliers needs to debug a problem with an application by logging remotely into one of our servers. They'll need to have root access, which I plan to provide via ssh and sudo.

I generally trust the supplier, or I wouldn't consider it, but I'd like to have some logging of their actions.

I tried installing sudosh, but couldn't get it to run due to segmentation faults. A search turned up some hacks and tips, but no serious options.

How can I log all shell input output that a user or sudo creates?

share|improve this question

3 Answers 3

up vote 2 down vote accepted

sudo does some logging. You can also limit what commands they can use. You can use the logging capability of screen (plus its multi display mode). You can even use my Bash logging functions. A combination of these will provide layers of insurance.

Ultimately, it's difficult to prevent a user with root privileges from bypassing stuff like this, so be wary.

share|improve this answer
1  
Yes, sudo's logging is a bit to limited, since it doesn't log when people start a login shell via 'sudo -i'. Something like screen or bash that logs all standard in and out, and starts automatically would be fine. Im aware how easy it is to circumvent, but don't expect them to do that. It's more for documentation purposes. –  Martijn Heemels Jan 4 '10 at 14:41
    
+1 for mentioning "screen". –  paxos1977 Jan 4 '10 at 16:14

script will "make typescript of terminal session"

seems to record everything, which could be handy, but does fall apart slightly if you're using VIM or other things that mangle the VT.

The other thought that jumps to mind, is to give the contractor login details for a 'completely safe account' (eg one without any permissions) and have him run screen -x to attach to an already running root shell (that you've set up and are keeping an eye on). -the contractor never needs to know root passwords or have access to sudo and you can watch (and record using script) anything that they do.

share|improve this answer

Could you not share access to your desktop via something like vnc or an alternative and have them access the console via your machine. That way you can sit and watch and see exactly what they are doing?

share|improve this answer
    
I've done this in the past. It's a pretty good way to do it, tbh. You can also terminate their session if they start to do naughty things. –  Tom O'Connor Jan 19 '10 at 9:18

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.