0

I am looking for a way to run SSH (OpenSSH in particular, but not necessarily) and log all commands that I run against the remote, to a file locally.

Running each command as an independent ssh command would indeed log each command to my local history, but it is generally UNdesirable to run e.g.

ssh notroot@something.example.com -- foo -a --bar baz

for every command.

I'd rather ssh into the server in a normal way, either through ssh itself, or through a wrapper command, like 'ssh-logging'.

I'm envisioning the program saving commands input through ssh into a file on the local client machine comparably to how shells do it, e.g. ~/.ssh_history seems like a good default, perhaps permuted per user+host combination, but I don't really care where it saves at this moment.

In short, I'd like something like the following to happen:

~ $ ssh user@host.example.com
[user@host ~]$ foo --bar
[user@host ~]$ exit
~ $ cat .ssh_history_user@host
foo --bar
exit
~ $

Does such a thing exist, either as an obscure OpenSSH client configuration, or as part of another open-source/libre ssh client, or as a thin wrapper program that can simply place themselves in the way of the user's stdin inputs, and transparently send them to the stdin of the running program while logging them? (I hear SecureCRT has a logging feature that is perhaps roughly like this, but at least in my personal life I have no desire to use non-FLOSS tools).

  • What stops you from ssh user@host | tee ssh.log ? – Eugen Rieck May 4 '15 at 19:13
  • @EugenRieck Ignorance and lack of sufficiently honed intuition regarding many of the tools in the typical *nix command-line toolbox, is what was stopping me. I think you just answered my question. Thank you! – mtraceur May 4 '15 at 19:45
0

If you're on unix, the standard utility script is designed for this purpose. If you run script with no arguments, it starts a copy of your shell and logs the session to a file named "typescript":

~ jdoe$ script
Script started, output file is typescript
bash-3.2$ date
Fri May  8 16:29:44 EDT 2015
bash-3.2$ exit
exit

Script done, output file is typescript
~ jdoe$ cat typescript
Script started on Fri May  8 16:29:42 2015
bash-3.2$ date
Fri May  8 16:29:44 EDT 2015
bash-3.2$ exit
exit

Script done on Fri May  8 16:29:45 2015
~ jdoe$ 

You can specify the file to log to and the command to run instead of the shell. This part isn't completely standardized. On my OSX system, you'd run it like this:

script name-of-log-file command arg...
eg
script ssh-log ssh user@somehost

With the common linux version, you'd run it like this:

script -c 'command arg...' name-of-log-file
eg
script -c 'ssh user@somehost' ssh-log
| improve this answer | |
  • Apologies for the late reply. I am undecided about accepting this answer, but I did upvote it because I found it helpful (at the time of this writing, it doesn't publicly show up, because I don't have sufficient reputation, as I understand it). – mtraceur Sep 11 '15 at 21:04
  • One other advantage of this that I have found, and perhaps which is worth adding to your answer, is that most implementations of script can also save timing information, and be combined with scriptreplay to see exactly what happened, with the correct timing of what happened. – mtraceur Sep 11 '15 at 21:33
  • After a couple of years of thought on the matter (and deeper grokking of the Unix philosophy in the meantime), I decided that script, although not always producing portable files (for example I've seen issues between GNU and BusyBox scripts replaying each other's timing files), is basically the best and most appropriate answer this question will ever get, so I've gone ahead and accepted this answer too. – mtraceur Jun 2 '18 at 12:11
0

Thanks to Eugen Rieck's comment about piping ssh through tee, I was able to implement a logging wrapper around ssh which does what I was looking for.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.