Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I need a method to audit commands that a specified user type in an ssh connection to my server .

Any Help ?

share|improve this question
add comment

1 Answer 1

up vote 2 down vote accepted

If the user isn't intentionally hiding their activity would something like this work?:

cat ~/.bash_history | grep "name_of_command"

Or

cat /home/user_name_here/.bash_history | grep search_string

Although it might be a better solution to enable PAM (Pluggable Authentication Modules) TTY auditing: (http://manpages.ubuntu.com/manpages/trusty/en/man8)/pam_tty_audit.8.html

Install auditd (note: make sure ssh server is installed) and reboot:

sudo apt-get install auditd && sudo reboot

Remove any pam_tty_audit:

sed '/pam_tty_audit.so disable=/d' /etc/pam.d/sshd

Append enable string to the pam.d configuration files:

sudo sh -c "echo 'session required pam_tty_audit.so enable=*' >> /etc/pam.d/sshd"

Start auditd:

sudo service auditd status

If it is not running:

sudo service auditd start

And grep tty report for a users UID:

sudo aureport --tty | grep $(id -u username_here)

Related Reading:

http://doc.opensuse.org/products/draft/SLES/SLES-security_sd_draft/cha.audit.comp.html#sec.audit.auditd

http://serverfault.com/questions/336217/how-do-i-log-every-command-executed-by-a-user

http://www.cyberciti.biz/tips/linux-audit-files-to-see-who-made-changes-to-a-file.html

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.