How can I setup
rsyslog to log commands typed in a ssh session?
Just in case someone unauthorized ever accesses the system, I'd like to know what he did.
Server Fault is a question and answer site for system and network administrators. It only takes a minute to sign up.Sign up to join this community
What it sounds like to me is that you want to audit what a user does once he's logged into your server. This is really more a function of the shell that your user is running (like bash).
You can probably employ the same thing for any user who's logging in remotely.
There aren't many readily available options to do this at the moment.
Some of my coworkers at Lawrence Berkeley National Lab (LBNL) have released a series of patches to OpenSSH as part of their auditing-sshd project. The code is open and available under the "BSD Simplified" license.
auditing-sshd logs all keystrokes typed by a user, as well as a ton of other meta-information about the SSH transaction. The data is sent using syslog/stunnel to a central IDS. Some shell-based auditing tools can be bypassed from the commandline. Since the code is embedded into OpenSSH, the attacker cannot bypass the tool while using SSH.
That said, binary packages are not readily available and the software is intended for admins who can apply the patches into the OpenSSH source and build their own packages.
Note: I am affiliated with this project. I work at LBNL, I know the authors personally and I use this software regularly.