Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Is there any way to listen in on port 22, on my server, to see if anyone submitted any commands while ssh'd into my server? Or rather, output what commands were submitted (and the ip address of who connected), almost like a 'live' log?

share|improve this question
add comment

4 Answers

Assuming it's a Linux box, to look at attempted SSH connections, try:

tail -f /var/log/auth.log
share|improve this answer
add comment

You can't listen on the port (SSH is doing that already) and you can't snoop the traffic (it's encrypted). What you can do though is enable Process Accounting. This keeps a record of each process run and how much processor time was used running it.

It was primarily for billing people using mainframe systems, but is still lingering around even now, and is quite handy for security auditing.

This FAQs.org entry tells you all about how to turn it on: http://www.faqs.org/docs/Linux-mini/Process-Accounting.html

And of course, don't forget to read the man pages of those useful accounting commands.

share|improve this answer
    
AFAIK, process accounting only keeps the program names; something like auditd is needed to log detailed data. –  grawity Apr 29 '11 at 12:25
add comment

In the sshd configuration file, you can change the shell invoked to a wrapper that logs everything; perhaps script. I've never tried this, and it would be difficult to make it tamper-proof.

share|improve this answer
add comment

You can't listen directly on the port as ssh is by design encrypted (SECURE SHell)

There is no standard way, but adding

HISTFILE=/tmp/`whoami`-log

to the system bashrc or somesuch would probably work assuming your users aren't too wise.

If you're concerned about what users are doing on your machine you should be looking at alternatives like FreeBSD's jails or some form or restricted shell.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.