cancel
Showing results for 
Search instead for 
Did you mean: 

Linux log

 
Duffs
Regular Advisor

Linux log

Hi,

I am using RedHat AS4 and I need to capture the ssh login details of different users including the commands they use whilst logged in. So far this level of detail does not get logged in either the messages file or the secure log file.

Does anybody know of additional software or possibe ssh logging options that might enable me capture this amount of detail?

Rgds,
D.
8 REPLIES
Alpha977
Valued Contributor

Re: Linux log

Hello!

Usually you can see the ssh log connection into /var/log/secure.

If i remember, iptables write into this log files and you can see there.
Duffs
Regular Advisor

Re: Linux log

Hi,

I know that the secure log provides limited ssh detail but it does not include the commands that are used by individual users while logged in. I am not using iptabes and have SElinux disabled so this is of no use to me.

R,
D.
Ivan Ferreira
Honored Contributor

Re: Linux log

You can use process accounting (accton, lastcomm, etc).

Another option is to use the script command. Add the script command to the /etc/profile catching selected user (if). See man script for details.
Por que hacerlo dificil si es posible hacerlo facil? - Why do it the hard way, when you can do it the easy way?
Heironimus
Honored Contributor

Re: Linux log

If you need that level of auditing you can't rely on /etc/profile or any other login script because they're too easy to bypass. If you only want to audit shared accounts like oracle a locked password and proper sudo access would do it. Another option is to use a special auditing shell such as EASH that captures all keystrokes, but that is extremely invasive and may log sensitive information such as passwords.
Silju
Advisor

Re: Linux log

Hi Duffs,

Power Broker is the software you are looking for. It can do more than just loging the activities of the user.
You can get more details on this site.
http://www.symark.com/powerbroker.htm

SUDO also can help you in this case.
http://www.gratisoft.us/sudo/sudo.html


Regards
Silju
Technology to empower all
George Liu_4
Trusted Contributor

Re: Linux log

Change
LogLevel
in /etc/ssh/sshd_config

The possible values are: QUIET, FATAL, ERROR, INFO,VERBOSE, DEBUG, DEBUG1, DEBUG2 and DEBUG3. The default is INFO.
Ivan Ferreira
Honored Contributor

Re: Linux log

See also:

Enterprise Audit Shell (eash)
Por que hacerlo dificil si es posible hacerlo facil? - Why do it the hard way, when you can do it the easy way?
Duffs
Regular Advisor

Re: Linux log

Thanks for the feedback. I went with sudo.
R,
D