I have an idea for my project like this. I had already root access of a server. The users in this server are using SSH to connect with. What I wanna do is to somehow when they use SSH to connect to the server so I would be able to redirect their connection to another server ( which I have set up before) to capture their actions.

I have tried to use Logskey. Unfortunately it didn't work when users using SSH to connect.

I am sorry if my idea is dumb and if you have anything good solution please help me.

Thank you so much.

  • If you already have root access you can sniff traffic on port 22. SSH is encrypted so you won't be able to see anything anyway. – mbiber Oct 10 '16 at 16:27
  • I'm doing this way as well. I have the reverse TCP connection in their server. But they are trying to install some kind of logs service and using Netstat to see what port is listening. Then now I am finding a way to take their password to connect to SSH, so they will think it's their teammate. @mbiber – Ender Phan Oct 10 '16 at 16:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.