3

I'm going to setup a Linux console box for login to Cisco devices via ssh only from that Linux machine. How I can setup ssh client on Linux to log all commands applied to Cisco devices?

2

You can use the script command to log all the terminal output, which under normal circumstances include all the typed commands.

An invocation could look like this if you want to append to a single file:

script -a -f -c 'ssh cisco.example.com' /var/local/log/ssh-cisco.log

Or like this if you want separate files per invocation:

script -f -c 'ssh cisco.example.com' "/var/local/log/ssh-cisco-$(date date +%Y-%m-%d_%H:%M:%S.%N).$$.log"

If the user were required to type those commands themselves, they would of course be too lazy to do all that extra typing to enable logging. And writing the entire thing in a shell script might not be good enough for you either, since I am assuming you don't want the users to be able to bypass the logging.

So you want to avoid the users having access to bypass the logging, and you don't want them to have write access to the directory containing the logs either.

You could setup a separate group which has read access to the ssh key and write access to the log directory. Then you can wrap the script command in a set-group-id executable or sudo.

0

I found a solution with "| tee -a logfile" Is there any other solution for that? I need only commands in logfile not all output, if that is possible.

  • The ssh client does not know about commands on the remote system. All it knows is a stream of input (key presses) and a stream of output. Using tee for the input would cause ssh to stop treating it as a terminal connection, and would also cause keys to be logged when not echoed, so passwords could end up in the log. – kasperd Apr 18 '16 at 9:55
0

Correct me if I'm wrong, but AFAIK, even CISCO devices have a .bash_history file. When you log in, all the commands are saved there in timeline order. Therefore I don't see the use of asking the SSH client to save every command you type.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.