Log ssh communications

Question

I have a closed source program which calls server over SSH and executes a set of commands.

Could you tell me how can I log all commands?

My server is under Ubuntu.

maybe this can help you http://serverfault.com/questions/559658/log-commands-executed-over-ssh/559683#559683 — c4f4t0r, Dec 26 '13 at 20:34
http://serverfault.com/questions/470755/log-all-commands-run-by-admins-on-production-servers/475134#475134 a more detailed answer explaining how to use `auditd` — fuero, Dec 26 '13 at 22:43

score 2 · Answer 1 · answered Jul 04 '11 at 23:38

2

Snoopy can be used to log all commands ran on a system. Logs will be sent to syslog.

answered Jul 04 '11 at 23:38

theotherreceive

8,235
1
30
44

score 1 · Answer 2 · answered Jul 04 '11 at 23:42

Without knowing exactly how it's doing it's thing, there's no one answer that I can give. However, a few possibilities:

It uses keys for authentication, and runs a command it passes at login: This is easy. Add a command= to the entry in ~/.ssh/authorized_keys that calls a script that logs the command it runs, and then just execs the command. Transparent, simple.
It uses keys for authentication, runs a shell, and stuffs commands down the shell: Harder, but still straightforward. Again, command= in ~/.ssh/authorized_keys to run a shell of your choosing, which could be something like sudoshell or something else that logs all commands (for super bonus trickery, you could even use script for full replayability).
It uses passwords: No command= trickery allowed here, you're going to have to go the whole hog and use something like snoopy to log everything that happens -- but unless this program is the only thing using SSH, you'll likely end up with a lot of logs.

the program can use key based auth. do you have script sample to log calls? thank you — user349302, Jul 05 '11 at 00:11

score 1 · Answer 3 · edited Dec 26 '13 at 20:28

1

If the close source program allows you to edit remote SSH parameters or you can put the commands into a shell script, you can wrap your execution around the "script" command on the remote server like this:

ssh 192.168.15.200 'script ps.log -c "ps -ef"'

In this case, the output of ps -ef is saved into the file ps.log

edited Dec 26 '13 at 20:28

dyasny

18,482
6
48
63

answered Jul 04 '11 at 23:51

Rilindo

5,058
5
26
46

Log ssh communications

3 Answers3