Linux log

[Duffs]

Hi,

I am using RedHat AS4 and I need to capture the ssh login details of different users including the commands they use whilst logged in. So far this level of detail does not get logged in either the messages file or the secure log file.

Does anybody know of additional software or possibe ssh logging options that might enable me capture this amount of detail?

Rgds,
D.

[Alpha977]

Hello!

Usually you can see the ssh log connection into /var/log/secure.

If i remember, iptables write into this log files and you can see there.

[Duffs]

Hi,

I know that the secure log provides limited ssh detail but it does not include the commands that are used by individual users while logged in. I am not using iptabes and have SElinux disabled so this is of no use to me.

R,
D.

[Ivan Ferreira]

You can use process accounting (accton, lastcomm, etc).

Another option is to use the script command. Add the script command to the /etc/profile catching selected user (if). See man script for details.

[Heironimus]

If you need that level of auditing you can't rely on /etc/profile or any other login script because they're too easy to bypass. If you only want to audit shared accounts like oracle a locked password and proper sudo access would do it. Another option is to use a special auditing shell such as EASH that captures all keystrokes, but that is extremely invasive and may log sensitive information such as passwords.

[Silju]

Hi Duffs,

Power Broker is the software you are looking for. It can do more than just loging the activities of the user.
You can get more details on this site.
http://www.symark.com/powerbroker.htm

SUDO also can help you in this case.
http://www.gratisoft.us/sudo/sudo.html


Regards
Silju

[George Liu_4]

Change
LogLevel
in /etc/ssh/sshd_config

The possible values are: QUIET, FATAL, ERROR, INFO,VERBOSE, DEBUG, DEBUG1, DEBUG2 and DEBUG3. The default is INFO.

[Ivan Ferreira]

See also:

Enterprise Audit Shell (eash)

[Duffs]

Thanks for the feedback. I went with sudo.
R,
D