On Tuesday, September 11, 2018 5:24:47 PM CEST Grant Taylor wrote: > On 09/11/2018 06:51 AM, wiicontrol...@gmail.com wrote: > > If by “all” activity, the customer means all activity, pam_tty_audit is > > the only solution I have heard of that fits the bill: > > > > https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/h > > tml/security_guide/sec-configuring_pam_for_auditing > I'm not familiar with pam_tty_audit, and I didn't see / find ssh in the > linked page. Does pam_tty_audit capture content from SSH sessions? > What about ssh remote command execution?
SSH can (it does by default) use PAM for authentication. I would suspect it only logs access and not actions. > I can conceptually see how it could if it hooks low enough into the tty > layer. Xen logs all output of the VM to a text file if it is started automatically. This is done by attaching it to a screen-session and having screen log it all to a text file. If there is a reliable method to force SSH-sessions into something like this, you can log all input and output. > > If by “all” activity, the customer means, “We want want a Serious > > Business Stamp,” I recommend getting creative with your shell's > > $HISTFILE, given that 98% of your activity occurs there. > > I discourage this. > > 1) Depending on how it's done, it can break history across sessions. > 2) The $HISTFILE is inherently user writable. Which means that the > user can modify it. > 3) The $HISTFILE is a convenience. > 4) The $HISTFILE is NOT an audit log. > 5) Depending on how the shell is configured, commands can bypass the > $HISTFILE. > 6) The $HISTFILE does nothing for people putting commands in a script > and then running the script. — I had someone do exactly this at my > last job. 7) When using multiple sessions to the same account, the last session being closed determines the content of $HISTFILE. > I *HIGHLY* recommend running as much as you can through sudo. Sudo > events do end up in syslog on every system I've used. Does sudo have a shell-mode? -- Joost
