topic Re: track commands using ssh (with passphrase) in Operating System - Linux

track commands using ssh (with passphrase)

leonardo bianchi quota — Tue, 26 Jul 2005 04:02:18 GMT

Hi, I would like to have a command history for ssh connections for authenticated hosts.
I noticed that by default, without passphrase, commands are logged in .bash_history file. Otherwise using passprhase, commands are not saved anywhere.
How could I manage?

Thank You.

Leonardo.

Re: track commands using ssh (with passphrase)

Muthukumar_5 — Tue, 26 Jul 2005 04:04:06 GMT

It will be located in /var/log/messages file. You can also get history login informations with last command.

hth.

Re: track commands using ssh (with passphrase)

Stuart Browne — Tue, 26 Jul 2005 04:11:11 GMT

That's odd.. '.bash_history' is for all login sessions, regardless of how they came in.

Something to verify on one of your passphrase sessions is to the content of the 'HISTFILE' environment variable:

echo $HISTFILE

It should point to '.bash_history' in the user's home directory.

Re: track commands using ssh (with passphrase)

Ivan Ferreira — Tue, 26 Jul 2005 08:39:47 GMT

If you will use the solution described above, you must ensure that the HISTFILE, HISTSIZE environment variable is read only, if this variable is unset or changed to nothing, then the commands will not be logged, and you wont accomplish your objetives.

readonly HISTFILE=path_to_file
readonly HISTSIZE=10000

Also, is better if set the HISTFILE on a directory that cannot be accesed to any other except root, so it wont be deleted.

There is a command called script, that can help you too. Also, you can enable auditing.

Re: track commands using ssh (with passphrase)

Muthukumar_5 — Wed, 27 Jul 2005 03:10:05 GMT

You can make it with /etc/profile easily. Previously, I was suggesting solution for keep tracking ssh connection information. To me command history you have to set HISTFILE as,

--/etc/profile
set -o vi
export HISTFILE=$HOME/.ssh_history
export HISTSIZE=1000

It will setting history file. Anyway, If you want to set it only for SSH login then,

-- /etc/profile --
ps | grep -q 'ssh'
if [[ $? -eq 0 ]]
then
set -o vi
export HISTFILE=$HOME/.ssh_history
export HISTSIZE=1000
fi

It will be logging ssh related history into $HOME/.ssh_history.

Any terminal login (non cde) will use /etc/profile always.

hth.

Re: track commands using ssh (with passphrase)

Steven E. Protter — Thu, 28 Jul 2005 08:56:34 GMT

If HISTFILE and HISTSIZE are both set, HISTSIZE to a reasonable size, the commands should be tracked on the server you are connecting to.

I think you should check ownership/permissions on the server. That might explain the mystery here.

SEP
Israel