I have a root user using a java application that logs into the servers I administrate. When this ssh client logs in, it doesn't write an entry in wtmp (or utmp that I can tell). It does not seem to leave behind any command history (bash is being used). It does leave behind log entries in
/var/log/secure, and the connections do show up in a '
netstat' command, however, nothing shows up in a '
w' or '
last' or '
who'. The user is trusted, but it becomes a problem when diagnosing issues and tracing command history. It is also a security risk (if this user can do it, so could others).
Is there a way (sshd config?) to force all incoming ssh connections to write a wtmp entry and also command history like normal?