Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need a method to audit commands that a specified user type in an ssh connection to my server .

Any Help ?

share|improve this question
up vote 2 down vote accepted

If the user isn't intentionally hiding their activity would something like this work?:

cat ~/.bash_history | grep "name_of_command"

Or

cat /home/user_name_here/.bash_history | grep search_string

Although it might be a better solution to enable PAM (Pluggable Authentication Modules) TTY auditing: pam_tty_audit.8

Install auditd (note: make sure ssh server is installed) and reboot:

sudo apt-get install auditd && sudo reboot

Remove any pam_tty_audit:

sed '/pam_tty_audit.so disable=/d' /etc/pam.d/sshd

Append enable string to the pam.d configuration files:

sudo sh -c "echo 'session required pam_tty_audit.so enable=*' >> /etc/pam.d/sshd"

Start auditd:

sudo service auditd status

If it is not running:

sudo service auditd start

And grep tty report for a users UID:

sudo aureport --tty | grep $(id -u username_here)

Related Reading:

http://doc.opensuse.org/products/draft/SLES/SLES-security_sd_draft/cha.audit.comp.html#sec.audit.auditd

http://serverfault.com/questions/336217/how-do-i-log-every-command-executed-by-a-user

http://www.cyberciti.biz/tips/linux-audit-files-to-see-who-made-changes-to-a-file.html

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.