ssh monitoring tool

unix.fresher · 03-16-2010, 01:00 PM

Is it possible to record all the activities(command execution) of an user, who is login my server using ssh? Basically I want a GUI base tool, who will give me a report about remote login users' activities with time stamp.
Please help me.
I am using RHEL5.3

acid_kewpie · 03-16-2010, 01:51 PM

A gui for something as simplistic as that? really? just run "who" for a list of currently logged in users.

frndrfoe · 03-16-2010, 02:08 PM

Try audit
...not a gui

avtandil_k · 03-16-2010, 02:09 PM

I'd run w to see who is on and what is that user doing. Red lined is the ssh user connect to a Centos 5.4:
[root@centos54 ~]$ w
15:04:09 up 12 days, 1:54, 2 users, load average: 0.04, 0.05, 0.00
USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
root pts/0 10.45.31.189 15:03 0.00s 0.03s 0.01s w
samuel pts/1 10.45.31.189 15:04 3.00s 0.02s 0.02s -bash

acid_kewpie · 03-16-2010, 02:17 PM

remember that how a user a user is connected bears no relation to what they're doing on the system.

unixfool · 03-16-2010, 06:41 PM

If they're logged in (verified by the 'w' or 'who' command), they logged into an existing user account. Check the .bash_history file of that particular user to see what commands were run. You may need to adjust the history buffer to capture a larger snapshot for those who have busy sessions.

unix.fresher · 03-16-2010, 11:34 PM

Thanks Friends.

unSpawn · 03-17-2010, 04:22 AM

A user can reconfigure its shell behaviour to avoid logging by linking history to /dev/null (oldest trick in the book) or setting log file size or history size. If you need a solution that unprivileged users can't mess around with see 'rootsh'. Make 'rootsh' and syslog log to a separate protected syslog server if you need to tamper-proof it further.

avtandil_k · 03-17-2010, 11:48 AM

Also the whowatch will give you a more detailed info. It's not a gui but a tui.
Check if you can get it installed on RHEL.
It is apt-get install whowatch on Debian.

Definitely can use this on CentOS. I used whowatch-1.4-1.2.el5.rf.x86_64.rpm and installed with no issues.