I would like to know how i could log SSH command lines a user is using on a server. For exemple, if the user Alex on my server is doing the following set of commands :
$ cd /tmp
$ touch myfile
$ ssh staff@10.0.0.1
$ ssh staff@10.0.0.2
$ vim anotherfile
$ ssh alex@192.168.0.12
I would like to log the ssh commands used on the server in a file which looks like :
[2014-07-25 10:10:10] Alex : ssh staff@10.0.0.1
[2014-07-25 10:18:20] Alex : ssh staff@10.0.0.2
[2014-07-25 11:15:10] Alex : ssh alex@192.168.0.12
I don't care what he did during his ssh session, i just want to know WHEN and TO WHERE he made a connection to another server.
The user is not using bash and i would like to avoid manipulating .bash_history anyway as the user can modify it.
Any clue on this ?
Thank you :)
edit : to be more specific :
a user connects to a server A and then connects from the server A to server B. I want to track down to which server he connects through ssh from server A.
LogLevel
in sshd to one of the DEBUG levels? sshd_config(8) says that this "violates the privacy of users and is not recommended"... sounds like just what you want! – Andrew Schulman Sep 25 '14 at 10:13auditd
. It's better if you want to quickly filter by criterion and make your search easier on activity logs. – Xavier Lucas Sep 25 '14 at 10:28if [ $0 = '-bash' ]; then . /etc/bashrc fi
– Kevin Merigot Sep 26 '14 at 13:38