1

I've got a bit of a puzzler - I am an administrator on both a Windows 10 and a Mac Catalina machine.

The Windows machine is currently running software that has a known bug - SSH commands are sent to a Mac by a large piece of .NET Software that is difficult to RE (due more to its size than complexity) over SSH. The 2 PCs are on the same network.

The SSH commands fail, but I don't know what they are. I would like to record these actions, or at least view them in some way, so I can change the behavior of the receiving end (Mac) to take the correct action (bug workaround).

Here is what I've tried to view the SSH commands:

  • Run Wireshark (on both sides), try to decode the Diffie-Hellman exchange via SSH keys (I don't know how this works exactly, so I'm fumbling my way through - e.g. I don't know how to use RSA keys to decode the conversation)
  • Try Strace - doesn't exist on Mac machines. Alternative option dtruss may work but I don't know the commands and have to bypass SIP.
  • Try to log SSH commands by using .bashrc auto-logging - this has now been replaced by .zprofile and .zshrc - this doesn't appear to work, and no history is left in z_history or bash_history. It works when I run interactive Terminal commands though. This may be due to commands being chained to the initial SSH command, e.g. ssh user@host SOMECOMMAND.
  • Run ProcMon, see if the commands are in some secret config file. Can't seem to find it.
  • Decompile using Reflector and dnSpy - I find some logic on how to transmit SSH commands, but no hard-coded actual commands.

What am I missing? Is there some obvious way to do this that I've overlooked?

I am relatively versed in making things work, so if I have an idea of the best path forward, then I'll focus my attention there. There just seem to be too many options in a large space to know how to proceed..

I've read there are maybe ways to do this via the sshd_config on the SSH host (Mac), but I have no idea which settings would actually work, and apparently Mac does things in a special way.

[Please feel free to move the appropriate StackExchange site, not sure which is best for this]

Improve this question
5
  • As a minor update - I've tried to use pam_tty_audit.so to record commands in the sshd config file /etc/pam.d/sshd, but this lib crashes SSH
    – Coruscate5
    Mar 30, 2020 at 21:38
  • You say this is a known bug, have you thought to contact the developer's bug list to find out the commands they are trying to execute? The other option would be to look at the MAC end of the equation rather than trying to get the commands before they are executed, see what they are on the client side. Is the SSH session created(last)? anything logged in /var/log/dmsg? if you are not seeing a session created, then you are having a more basic problem of how the connection is being set up. Can you SSH to to the mac from the PC?
    – Rowan Hawkins
    Mar 30, 2020 at 22:53
  • @RowanHawkins - SSH works fine - MSFT is aware of the problem, but I'm more curious how to do any sort of SSH recording. There doesn't appear to be a /var/log/dmsg on my Mac, unless I'm missing something. Further, if I run a standard SSH session (without chaining commands) I can record commands using 2 tricks, script and expect, which come from other techniques. But I still get nothing from the MSFT SSH session.
    – Coruscate5
    Mar 31, 2020 at 1:22
  • Honestly, at this point I'd bet that DTRUSS is my best bet, but every time I turn it on it gives me nearly unintelligible raw system logs - I can't seem to find anything that resembles actual commands in there.
    – Coruscate5
    Mar 31, 2020 at 1:24
  • Consider this URL suggestion, please. en.wikipedia.org/wiki/Tee_(command) With your MAC version, you may have something similar. With my Windows 10, TEE is available.
    – Wilson Hauck
    Apr 6, 2020 at 12:28

2 Answers 2

Reset to default
1
+100

This looks like a typical case for auditing. I've no experience configuring it on Mac OS, therefore the references to some documentation and examples:

https://opensource.apple.com/source/OpenBSM/OpenBSM-21/openbsm/man/

https://krypted.com/mac-os-x/quick-dirty-openbsm-auditing-macos/

It looks like a type of auditd is also available:

https://opensource.apple.com/source/system_cmds/system_cmds-336.10/auditd.tproj/auditd.8.auto.html

Enabling auditing, and parsing logs should work and contain all commands that had been executed on the destination system.

E.g knowing the ssh user you can start with audit_user and configure ex syscalls to be logged for this specific user. In case the user is changed during the session it might not capture all, but at least up to the user switch command.

/etc/security/audit_user yoursshuser:ad,ex:no

For a quick start try something like auditreduce -u <userid> -c ex /dev/auditpipe | praudit

This should provide live logs from the users exec syscalls.

Suggest to forget any approaches through shell histories and the like, as you don't know if a shell is used. E.g. a script is copied over and shell is just switched. Interesting are ex syscalls, these contain all executions, no matter how these are triggered.

EDIT FOR MAC: Specifically for Mac (with System Integrity Protection [SIP] on, e.g. Catalina/El Capitan/etc), OpenBSM will not record bash commands that don't result in actual execution of a program.

If you would like to record incorrect commands (e.g. ASDFASDFASDF), then the best option appears to be using dtruss - dtrace may also work, but the difficulty in getting it to work properly appears to be higher.

First, disable SIP, then run the following to record all system calls for bash processes: 

sudo dtruss -n bash

Incorrect commands will be "searched for" in various environment locations, in the stat64 calls. E.g. stat64("/usr/bin/ASDFASDFASDF",...)

Improve this answer
24
  • I spent a good 3-4 hours working on PAM to get auditd to do what it can do in Linux to no avail, but I'll take a look at the sources you provided to see if I missed something, thanks
    – Coruscate5
    Apr 3, 2020 at 19:04
  • I'd also mention that the pam_audit_tty.so lib either doesn't exist on Mac or is non-functional, because applying it crashes all SSH sessions
    – Coruscate5
    Apr 3, 2020 at 19:07
  • In my opinion the suggested solution should be unrelated to pam and sshd. Also I do think that the pam_tty_audit module was not made for sshd.
    – hargut
    Apr 3, 2020 at 19:10
  • After a quick look it seems that pam_tty_audit is only available for Linux. It was made for recording keystrokes on tty consoles, these are special devices, typically used for login at the hardware. Therefore not suited for sshd command recording, and most likely failing on OSX because the library cannot be found. The available pam modules should be located at /usr/lib/pam.
    – hargut
    Apr 3, 2020 at 19:23
  • 1
    Depends what "incorrect" means in this context, typically if the program is called e.g. with incrorect flags, the exec call should be listed, even if the program later on stops/fails e.g. due to argument issues. Another thing would be that a program to be called cannot be found, e.g. file not found. This should be traceable.
    – hargut
    Apr 7, 2020 at 17:34
0

If you have access to the shell where the commands are executed you could try to redirect the file descriptors in the shell's profile to a logfile. Or turn on history. Or use sysdig.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .