6

We have several employees who log into a virtual machine (OS 6/7) using the same user: root (it needs to be this way for various reasons).

Is there anyway to add the user's hostname/user's name to the login session, in order to see who did what and when?

Improve this question
2
  • 6
    with root you have no idea who did what. Create them separate limited users.
    – Jakuje
    Dec 27, 2016 at 14:17
  • 1
    What are those reasons? There is almost certainly a better solution, one that involves using the Operating System in the way that it was designed!
    – Lightness Races in Orbit
    Dec 28, 2016 at 15:55

2 Answers 2

Reset to default
12

First of all I agree with Slipeer about individual accounts really is the preferred solution. Yet, we do live in an imperfect world, and sometimes one is not in a position to implement the Right solution right away.

The most reliable option to identify different people using the same account is to look at the ssh key used to login. If you are using a recent enough OpenSSH that information will be provided by the default INFO LogLevel.

sshd[2425]: Accepted publickey for vagrant from 10.0.2.2 port 54576 ssh2: RSA SHA256:5cH1LgeZ+m/OuxpPeFc9bIql3pMaQl/mtym0mGmecNc

In case of an older OpenSSH that information is only available by way of the VERBOSE LogLevel.

sshd[2023]: Found matching RSA key: 3b:7f:2d:8f:3a:82:ae:69:02:4f:00:2c:71:5e:e0:6a
sshd[2023]: Accepted publickey for vagrant from 10.0.2.2 port 36164 ssh2

And yes, having a record of the ssh key used for login is also a good thing when it comes to individual accounts.

Improve this answer
2
  • Does that allow you to see who did what? Is there one sshd process ID per session?
    – Lightness Races in Orbit
    Dec 28, 2016 at 15:56
  • Thanks for the info. I was able to find which IP address was logged in and out via /var/log/secure. I guess that I will just have to cross reference with the info on this files and the history. Unless there's a better way.
    – Erdel
    Jan 3, 2017 at 16:52
25

Best choice:

  1. Set PermitRootLogin no in /etc/ssh/sshd_config (on modern systems, this is the default setting value)
  2. Create for each employer personal account
  3. Configure sudo to allow employers to run the needed commands with elevated privileges.

UPD. If you need to manage user accounts on multiple computers at enterprise - then you should look aside Identity management solutions.

Improve this answer
3
  • Thanks for the insights. While managing 200+ machines we need to work on the fly. Creating a user per employee will be hard to maintain on the long run.
    – Erdel
    Jan 3, 2017 at 16:32
  • @Erdel you may wish to implement something like NIS then, to centralise account management.
    – BE77Y
    Jan 9, 2017 at 14:56
  • 2
    @BE77Y NIS is pretty ancient, I wouldn't deploy it these days. Rather use FreeIPA.
    – Michael Hampton
    Jan 13, 2017 at 20:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .