Linux - SecurityThis forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
I'm looking for a keylogger/real-time SSH session monitor (if there is such util) for Slackware 10.1.
Kind of like a Terminal Server/VNC for SSH sessions. Where I don't have to 'cat log' or 'pico log', everytime.
Something like reading log files in real-time and seeing it update.
For What? :
This is for Administrative reasons. I want some people to ssh to my slackware 10.1 box, and I want to monitor them. Also, it's a part-time hobby of mine trying to be a Linux admin.
So far I tried Vlogger 2.1.1:
It's a great utility, but I don't know how to shut it off when I want it to. when I do ./vlogctrl unload, it says something like "rmmod: vlogger module is not loaded". When I go to the log file, I see it keeps on logging. I Wish I could turn it off when I want it to shut off. It also seems to crash my box causing a reboot and going through that disk check utility (when it does crash, vlogger won't run, so that's one way of shutting if off...heh). When I don't want it to shut it off, it works pretty well. Not sure if it produces output as if it were real time. (eg. vnc, terminal server)
I've been doing 'cat log' everytime to see the contents of the log file, which gets pretty cumbersome after a while,
I also tried using "TTYRPLD" but I couldn't get the patch to work (syntax was exactly the same in the instructions, but pertaining to my kernel) and it gave me some bogus error which I ignored, then later deleted the files, because I didn't know how to fix it.
Another program I looked into is LKL0.1.0, but it looks like it's used only for local purposes (correct me if im wrong).
You can also use roottail, it is a simple utility that will tail the log files and output them to your desktop, you can costumize it for diffrent log files and diffrent color scheme to alert you (visually) of what is going on log-wise.