Monitoring executed commands

Dig · 12-15-2010, 04:44 PM

I've firewall machine customers connect on it then connect to one of another 3 machines as root through ssh key , is there any way to know which user connect to which machine and what command that he has executed without using script command ?

unSpawn · 12-15-2010, 05:19 PM

Deny them root login on the edge firewall but give them an unprivileged user account. Deny them root login on the target machine and give them an unprivileged user account. Set up each machine to log to a central syslog server these users have no access to. Allow them to perform specific tasks using Sudo, use Rootsh for wrapping around shell sessions if Sudo isn't enough and use Auditd for logging tracking file access et cetera. And remember that once you allow a user root access it potentially is game over.