HP Secure Shell

[Phil Daws_3]

When using the syntax 'ssh -l ' is it possible to log the originators user name aswell as the one they are connecting as? This is so we can audit who is using a generic id.

[Bill Douglass · Accepted solution]

Not from within ssh (or sshd). The remote host only sees the connection as the different user.

You could put a wrapper around the ssh command that logs the real and desired usernames.

[John Bolene]

don't allow generic ID's

put everyone's specific ID on each machine, then have them su to whatever ID they need to

[Phil Daws_3]

I cannot believe that there is no way within SSH to capture this information. My problem is that I could write a C wrapper on HP-UX but most of the client connections are from PC workstations using a off-shelf package.

[Chris Vail]

Its never a good idea to use generic accounts, where multiple people have the same access. This is precisely for the reason you mention. However, you can trace a ssh connection back to a specific address by checking /var/adm/syslog/syslog.log. You'll see entries there like:
Jun 23 04:13:02 foo@bar.com sshd[21167]: Accepted publickey for henry from 1XX.1XX.1XX.24 port 53394 ssh2

This means that henry logged in from a particular system at a given time. If more than one person has access to 1XX.1XX.1XX.24, then you'll have problems. However, this could be the start of your audit trail.

The best thing is to disable shared accounts and insist that users have individual accounts. We make exceptions here for root, oracle, and tivoli, but then only senior, trusted people have those account passwords.