Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there any way to listen in on port 22, on my server, to see if anyone submitted any commands while ssh'd into my server? Or rather, output what commands were submitted (and the ip address of who connected), almost like a 'live' log?

share|improve this question

Assuming it's a Linux box, to look at attempted SSH connections, try:

tail -f /var/log/auth.log
share|improve this answer

You can't listen on the port (SSH is doing that already) and you can't snoop the traffic (it's encrypted). What you can do though is enable Process Accounting. This keeps a record of each process run and how much processor time was used running it.

It was primarily for billing people using mainframe systems, but is still lingering around even now, and is quite handy for security auditing.

This entry tells you all about how to turn it on:

And of course, don't forget to read the man pages of those useful accounting commands.

share|improve this answer
AFAIK, process accounting only keeps the program names; something like auditd is needed to log detailed data. – grawity Apr 29 '11 at 12:25

In the sshd configuration file, you can change the shell invoked to a wrapper that logs everything; perhaps script. I've never tried this, and it would be difficult to make it tamper-proof.

share|improve this answer

You can't listen directly on the port as ssh is by design encrypted (SECURE SHell)

There is no standard way, but adding


to the system bashrc or somesuch would probably work assuming your users aren't too wise.

If you're concerned about what users are doing on your machine you should be looking at alternatives like FreeBSD's jails or some form or restricted shell.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .