- Community Home
- >
- Servers and Operating Systems
- >
- Operating Systems
- >
- Operating System - Linux
- >
- Monitoring SSH sessions user activities
Categories
Company
Local Language
Forums
Discussions
Forums
- Data Protection and Retention
- Entry Storage Systems
- Legacy
- Midrange and Enterprise Storage
- Storage Networking
- HPE Nimble Storage
Discussions
Forums
Discussions
Discussions
Discussions
Forums
Forums
Discussions
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
- BladeSystem Infrastructure and Application Solutions
- Appliance Servers
- Alpha Servers
- BackOffice Products
- Internet Products
- HPE 9000 and HPE e3000 Servers
- Networking
- Netservers
- Secure OS Software for Linux
- Server Management (Insight Manager 7)
- Windows Server 2003
- Operating System - Tru64 Unix
- ProLiant Deployment and Provisioning
- Linux-Based Community / Regional
- Microsoft System Center Integration
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Community
Resources
Forums
Blogs
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Printer Friendly Page
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО01-08-2009 07:07 AM
тАО01-08-2009 07:07 AM
We have a server, where all users connect to before connecting to other servers beyond it.
Is there a way/tool which monitor each user what is doing on these servers (what commands they are performing) and save these info in a file.
Thanks,
Solved! Go to Solution.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО01-08-2009 07:30 AM
тАО01-08-2009 07:30 AM
Re: Monitoring SSH sessions user activities
Set the variables HISTFILE and HISTSIZE in the .profile for the user or /etc/profile and all commands will be recorded.
SEP
Owner of ISN Corporation
http://isnamerica.com
http://hpuxconsulting.com
Sponsor: http://hpux.ws
Twitter: http://twitter.com/hpuxlinux
Founder http://newdatacloud.com
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО01-08-2009 07:43 AM
тАО01-08-2009 07:43 AM
SolutionWe're using the "sudosh" utility to record any activities on system & application admin accounts on some critical systems, but the documentation indicates it's usable as a login shell wrapper too:
http://en.wikipedia.org/wiki/Sudosh
It records everything the user sees and does.
It's available as a source package, so you'll have to compile it.
Remember to allocate plenty of disk space for sudosh logs if you use it. If you run out of disk space for logs, your log record will of course be incomplete.
MK
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО01-08-2009 08:45 AM
тАО01-08-2009 08:45 AM
Re: Monitoring SSH sessions user activities
sshd to wrap particular logins in a script command. That is very intrusive. There would be no privacy!
# Log all output for users in group 'audited'
Match Group=audited
ForceCommand script -qfa -c 'bash -i' /tmp/snoop_$USER
The user needs access to the file that script is writing. You can prevent them from overwriting that data if you direct script to write into a named pipe that the data is copied out of.
# mknod /tmp/snoop_user1
# chmod 600 /tmp/snoop_user1
# cat < /tmp/snoop_user1 >> /var/log/snoop_user1 &
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО01-09-2009 04:45 AM
тАО01-09-2009 04:45 AM
Re: Monitoring SSH sessions user activities
Sudosh was a good idea.