24

Is there any linux software to monitor an incoming ssh session. At a previous job I was told that if you ever needed support from Red Hat for example you could have them SSH into your machine and you could watch what they were doing.

I'm in a similar situation where I want to ssh into my friends machine to help him out but I want him to be able to watch what I'm doing for educational purposes and to ensure I don't do anything malicious.

Any suggestions?

Thanks

2

7 Answers 7

15

GNU Screen has this ability, you could allow a specific shell user to only operate through screen.

https://www.linux.com/training-tutorials/using-screen-remote-interaction/

3
  • 1
    Only issue with screen is that they will need to start the screen session once they login to see the session. Also as a tech who provided remote support and have done this, you cannot monitor all screen windows at once so they can still run commands in a another screen and hide it. Apr 27, 2015 at 20:39
  • 1
    This is mainly a link-only answer, and the link doesn't exist anymore.
    – cutrightjm
    Feb 29, 2020 at 1:15
  • @cutrightjm I have updated the link, now it works Aug 2, 2021 at 21:24
4

I think screen is what you're after, but if you don't want to sit there watching, and want to "video" a user's session, you can look at sudo shell.

If you set the user up with this as their shell, you can have a complete recording of everything that occurred, and you can the "replay" it back, and watch it when/if you need to.

The only possible downside to this is that the logs can grow very large, for example if they run a command like find /, you will have all that recorded too - so you'll probably have to pick which accounts to enable it for rather than doing it globally.

As for allowing vendors login access, this is probably perfect, because you have a complete audit trail of everything they did, everything (even backspacing) is recorded and stored for replay.

log_output is your recorder option for sudoers, and sudoreplay(8) is your player.

As per the sudoers man page:

log_output: If set, sudo will run the command in a pseudo tty and log all output that is sent to the screen, similar to the script(1) command. If the standard output or standard error is not connected to the user's tty, due to I/O redirection or because the command is part of a pipeline, that output is also captured and stored in separate log files.

In sudoers file, you would put something like this:

User_Alias SHELL_ACCOUNTS = root,jack
Defaults: SHELL_ACCOUNTS log_output

Or for group-based logging

Defaults:%shellusers log_output

See http://www.gratisoft.us/sudo/sudoers.man.html for details.

2
  • Could you give a bit more information? What exactly do you mean by "sudo shell"? How would I set a user's shell to that? Where would the logs get saved?
    – GJ.
    May 4, 2012 at 13:02
  • I've updated my answer with some details to clarify.
    – khosrow
    May 24, 2012 at 2:40
2

For a similar thing: Live view of Linux shell commands executed by another user?

2

I use whowatch on my server.

apt-get install whowatch
2
2

You can use script command. Build a line in .login or .profile of the user whose ssh session you want to monitor. When he logs in a script / log is generated of his I/O which gives you commands run and the output of those commands. In real time you can just tail the script and watch what the user does in real time.

Unable to paste a link for your referrance but you can just google on the command " script " and you will get the referrances.

1

You can use kibitz. Quoting from the man page:

kibitz allows two (or more) people to interact with one shell (or any arbitrary program).

On Fedora, it's included in the expect package.

0

screen or tmux .

tmux sharing is a little easier.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .