Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Is there a way to show the complete ssh and su chain in bash?

For example. In Server A as user aa:

su - ab
ssh ba@B
su - bb

Thus, I would like a command that prints something like this:

1 bash aa in A
2 su ab in A
3 ssh ba in B
4 su bb in B

I tried pstree but it does not print the users and only works with the processes of the last ssh'ed server:

$ pstree | grep -C 5 pstree
serversshd---sshd---sshd---bash---su---bash-+-grep
     |                                       `-pstree

Thanks and regards.

share|improve this question

migrated from stackoverflow.com Nov 15 '12 at 10:52

This question came from our site for professional and enthusiast programmers.

    
Related, maybe duplicate: Showing a stack of ssh connections in terminal –  Bobby Nov 15 '12 at 10:58

1 Answer 1

Here is what you can find easily (the server you come from) :

$ who
ba     pts/0        2012-11-14 22:47 (<A hostname>)

I do not think there are any readily available way to retrieve your full bash/ssh/su history. Here is what I would suggest to go a little further than your original pstree. But this is very sketchy, though.

Retrieving the sshd pid :

$ pstree -p | grep -B1 pstree
    |-sshd(8259)---sshd(23962)---bash(23965)-+-grep(24390)
    |                                        `-pstree(24389)

This allows you to find out which port on server A is connected to sshd on B :

$ lsof -i -P | grep 23962
sshd      23962        ba    3r  IPv4 36943568       TCP B:22->A:50174 (ESTABLISHED)

Then you could look for who is using this port on A :

$  lsof -i -P| grep 50174
ssh       19085        ab    3u  IPv4 0x81104c4d3b4ee24d      0t0  TCP A:50174->B:22 (ESTABLISHED)

Now you could use 19085 with pstree to figure out what has been done on A.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.