Log ssh sessions to rsyslog

Question

How can I setup rsyslog to log commands typed in a ssh session?

Just in case someone unauthorized ever accesses the system, I'd like to know what he did.

Answer 1

What it sounds like to me is that you want to audit what a user does once he's logged into your server. This is really more a function of the shell that your user is running (like bash).

Check out https://askubuntu.com/questions/93566/how-to-log-all-bash-commands-by-all-users-on-a-server

You can probably employ the same thing for any user who's logging in remotely.

Answer 2

There aren't many readily available options to do this at the moment.

Some of my coworkers at Lawrence Berkeley National Lab (LBNL) have released a series of patches to OpenSSH as part of their auditing-sshd project. The code is open and available under the "BSD Simplified" license. auditing-sshd logs all keystrokes typed by a user, as well as a ton of other meta-information about the SSH transaction. The data is sent using syslog/stunnel to a central IDS. Some shell-based auditing tools can be bypassed from the commandline. Since the code is embedded into OpenSSH, the attacker cannot bypass the tool while using SSH.

See the LISA 2011 Paper and slides. The purpose of these patches is to allow auditing of user sessions in academic and open research environments where auditing is required as part of the site security policy and the privacy policy is well understood by users.

That said, binary packages are not readily available and the software is intended for admins who can apply the patches into the OpenSSH source and build their own packages.

Note: I am affiliated with this project. I work at LBNL, I know the authors personally and I use this software regularly.