I want to create a script, possibly in python, open to suggestions, it logs every command typed on the server. so it would log, user, timestamp and command.
Is this possible?
Server Fault is a question and answer site for system and network administrators. It only takes a minute to sign up.Sign up to join this community
2 - You can also check Grsecurity to configure Exec logging at kernel level.
3 - Then you can done something like this (simple parsing code):
''A very simple log parser for ssh connections to display IP address and their User name''' SSH_LOG_FILE_NAME = '/var/log/secure' for line in open(SSH_LOG_FILE_NAME): if "sshd" in line: if "Accepted" in line: print "Connection is accepted from " print "User: ", line.split(), "IP: ", line.split() if "session closed" in line: print "Connection is closed from " print "User: ", line.split()
P.S. I think the second one is more easy to follow and shows how to parse it using sed which you can also do it easily in Python once you able to log all the commands.