I would like to know how i could log SSH command lines a user is using on a server. For exemple, if the user Alex on my server is doing the following set of commands :
$ cd /tmp
$ touch myfile
$ ssh [email protected]
$ ssh [email protected]
$ vim anotherfile
$ ssh [email protected]
I would like to log the ssh commands used on the server in a file which looks like :
[2014-07-25 10:10:10] Alex : ssh [email protected]
[2014-07-25 10:18:20] Alex : ssh [email protected]
[2014-07-25 11:15:10] Alex : ssh [email protected]
I don't care what he did during his ssh session, i just want to know WHEN and TO WHERE he made a connection to another server.
The user is not using bash and i would like to avoid manipulating .bash_history anyway as the user can modify it.
Any clue on this ?
Thank you :)
edit : to be more specific :
a user connects to a server A and then connects from the server A to server B. I want to track down to which server he connects through ssh from server A.
LogLevel
in sshd to one of the DEBUG levels? sshd_config(8) says that this "violates the privacy of users and is not recommended"... sounds like just what you want!auditd
. It's better if you want to quickly filter by criterion and make your search easier on activity logs.if [ $0 = '-bash' ]; then . /etc/bashrc fi