Listening on port 22

Question

Is there any way to listen in on port 22, on my server, to see if anyone submitted any commands while ssh'd into my server? Or rather, output what commands were submitted (and the ip address of who connected), almost like a 'live' log?

Answer 1

Assuming it's a Linux box, to look at attempted SSH connections, try:

tail -f /var/log/auth.log

Answer 2

You can't listen on the port (SSH is doing that already) and you can't snoop the traffic (it's encrypted). What you can do though is enable Process Accounting. This keeps a record of each process run and how much processor time was used running it.

It was primarily for billing people using mainframe systems, but is still lingering around even now, and is quite handy for security auditing.

This FAQs.org entry tells you all about how to turn it on: http://www.faqs.org/docs/Linux-mini/Process-Accounting.html

And of course, don't forget to read the man pages of those useful accounting commands.

Answer 3

In the sshd configuration file, you can change the shell invoked to a wrapper that logs everything; perhaps script. I've never tried this, and it would be difficult to make it tamper-proof.

Answer 4

You can't listen directly on the port as ssh is by design encrypted (SECURE SHell)

There is no standard way, but adding

HISTFILE=/tmp/`whoami`-log

to the system bashrc or somesuch would probably work assuming your users aren't too wise.

If you're concerned about what users are doing on your machine you should be looking at alternatives like FreeBSD's jails or some form or restricted shell.