Manage Open SSH sessions

BlueTornJacket · 02-10-2007, 08:57 PM

Is there any way I can view/monitor sessions that have been made from an external source to my ssh server?
I know there are various ftp clients out there that support session monitoring which lists things like connect time, active downloads etc. I'm simply looking for an SSH equivalent of this.

chort · 02-10-2007, 09:02 PM

Well the traffic is encrypted, so you're not supposed to know what they're doing... You can increase the log detail level, but that will reveal details like the user's passwords (if they use password authentication rather than public key).

BlueTornJacket · 02-10-2007, 09:29 PM

How would I go about increasing the log level detail? Is there a good log manager application you recommend so I don't have to manually go sifting through them?

Since the traffic itself is encrypted, but their shell is technically interacting with my hardware, can't i at least see what shares/files they may have open/be accessing?

prasanta · 02-12-2007, 05:52 AM

Just did a google search and found out this link. Shall try to implement it myself the same also. Hope it helps,

http://lists.freebsd.org/pipermail/f...ne/091000.html

--
Prasanta

BlueTornJacket · 03-10-2007, 01:44 PM

Although this post was made awhile back, I actually solved this issue and forgot to update the thread.

All commands than are run are actually stored in a file .bash_history in the users home directory.

The file only seems to store the last 1000 commands.

Running the command history dumps formatted output of this file. This file is user specific, so to get history of a specific users last bash commands first login to that user.

Hope that's helpful for any future readers who stumble over this.

btmiller · 03-10-2007, 07:10 PM

Just remember that users can modify their histories or turn off history file accounting, so the method is not good for real security work. If you're that paranoid, you can enable BSD style process accounting but it's generally not enabled in the kernel so you might have to recompile your kernel to get it working.

Edit: actually I take that last part back. Apparently it's configured by default at least for centOS 9and I assume Fedora) and Ubuntu systems. Note sure about others.