2

Problem: I have a production server I don't trust anyone with. However I can't be the only person to be able to access it.

Realization: I need to allow people log in as root, but through a proxy so that whatever they type/send over ssh is logged on a proxy machine to which they actually don't have access (so they can't tamper with logs).

What's the ideal setup to do that? I've only come across tshark (SSH Logging all Comamnds), but I'm not actually sure it's good for the job and not sure how exactly do I set it up as people say it logs traffic on the protocol level and ssh encryption happens on the application level.

Can anyone provide a definitive tested solution for this?

Improve this question

2 Answers 2

Reset to default
0

There is https://goteleport.com which should do exactly what you asking for. They say it's production ready, but I'm playing wit it and it seems to me as early development stage.

I'm looking for alternatives, so I found your question which is still relevant. I would go for commercial solution.

Improve this answer
0

You may try NHI: https://github.com/strang1ato/nhi

nhi automatically captures all potentially useful information about each executed command and everything around, and delivers powerful querying mechanism.

nhi keeps records of:

  • command
  • output of command
  • exit status of command
  • working directory at the end of command execution
  • start time of command
  • finish time of command
  • shell prompt at the time of command execution

nhi also keeps records of information about shell session in general.

[...]

nhi daemon is based on eBPF - a technology built into linux kernel. Usage of eBPF guarantee a great performance and low overhead of the tool, because tracing is being safely done inside kernel.

nhi does not affect behaviour of any program/process (and OS in general).

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .