track commands using ssh (with passphrase)

[leonardo bianchi quota]

Hi, I would like to have a command history for ssh connections for authenticated hosts.
I noticed that by default, without passphrase, commands are logged in .bash_history file. Otherwise using passprhase, commands are not saved anywhere.
How could I manage?

Thank You.

Leonardo.

[Muthukumar_5]

It will be located in /var/log/messages file. You can also get history login informations with last command.

hth.

[Stuart Browne · Accepted solution]

That's odd.. '.bash_history' is for all login sessions, regardless of how they came in.

Something to verify on one of your passphrase sessions is to the content of the 'HISTFILE' environment variable:

echo $HISTFILE

It should point to '.bash_history' in the user's home directory.

[Ivan Ferreira]

If you will use the solution described above, you must ensure that the HISTFILE, HISTSIZE environment variable is read only, if this variable is unset or changed to nothing, then the commands will not be logged, and you wont accomplish your objetives.

readonly HISTFILE=path_to_file
readonly HISTSIZE=10000

Also, is better if set the HISTFILE on a directory that cannot be accesed to any other except root, so it wont be deleted.

There is a command called script, that can help you too. Also, you can enable auditing.

[Muthukumar_5]

You can make it with /etc/profile easily. Previously, I was suggesting solution for keep tracking ssh connection information. To me command history you have to set HISTFILE as,

--/etc/profile
set -o vi
export HISTFILE=$HOME/.ssh_history
export HISTSIZE=1000

It will setting history file. Anyway, If you want to set it only for SSH login then,

-- /etc/profile --
ps | grep -q 'ssh'
if [[ $? -eq 0 ]]
then
set -o vi
export HISTFILE=$HOME/.ssh_history
export HISTSIZE=1000
fi

It will be logging ssh related history into $HOME/.ssh_history.

Any terminal login (non cde) will use /etc/profile always.

hth.

[Steven E. Protter]

If HISTFILE and HISTSIZE are both set, HISTSIZE to a reasonable size, the commands should be tracked on the server you are connecting to.

I think you should check ownership/permissions on the server. That might explain the mystery here.

SEP
Israel