I have a root user using a java application that logs into the servers I administrate. When this ssh client logs in, it doesn't write an entry in wtmp (or utmp that I can tell). It does not seem to leave behind any command history (bash is being used). It does leave behind log entries in /var/log/secure, and the connections do show up in a 'netstat' command, however, nothing shows up in a 'w' or 'last' or 'who'. The user is trusted, but it becomes a problem when diagnosing issues and tracing command history. It is also a security risk (if this user can do it, so could others).

Is there a way (sshd config?) to force all incoming ssh connections to write a wtmp entry and also command history like normal?

  • A wtmp entry is only written for interactive logins. The same applies to the bash history: bash will only update the history for interactive logins. The shell is invoked a lot of times for all sorts of scripts etc., if it had to update the history every time then that would take up a lot of time. – wurtel Jan 25 at 10:34
  • UPDATE: Yes, these are indeed interactive connections I'm concerned about, not script activity. I found out why the history is not showing; the history is updated only when the ssh connection is closed. The user stays logged in literally for weeks at a time, so I didn't see anything until the server was rebooted and the connection closed. – Emo Mosley Feb 11 at 15:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.