We have some servers that are only accessed by a few people. They are production critical, and therefore we would like to log all ssh access and commands issued to an external database.

Does anyone know offhand of a good method to do this. I was thinking of logging to syslog and then syslog handing off to a database.

However, I have not found any good information or patches for OpenSSH to make this happen. I checked the LogLevel directive for sshd_config and it just doesn't do what I want without cluttering the logs

Take a look at this project:
http://sourceforge.net/projects/snoopylogger/

Interesting. This wraps the exec() series of system calls to log to syslog. I have the info going to /var/log/snoopy right now.

The only issue with this is that it seems that your progs that use exec() series of calls has this info logged to syslog. While this can be good, it doesn't seem to discern between actual user typed commands and calls to exec() from within code.

There is a way to tune it for root only. So, I will check this further and may even extend the source to only cover calls from OpenSSH.

Thanks for the link,

Justin

As a dirty hack, you could have snoopy.c check for the existence of "SSH_CLIENT" or such, but someone could unset this environment variable and fork a sub-shell.

For /proc filesystems, I extended the code to see if the process is the ancestor of a certain named process. However, it is not fool-proof. For instance, its possible to run a process in the background, detached from any ancestor, and thus it would evade any such detection.

On the other hand, it might be possible to extend this code further to exclude processes that are children of, say, cron. But I would prefer to simply log the process with its associated caller. So, for instance, if the current process doesn't have a controlling terminal, find the oldest non-init ancestor process and log that information. This way things like logwatch can better decide how to deal with such info.

Check on the sourceforge bulletin boards for the patch I posted there.