Log remote execution over SSH

Thread Tools Search this Thread
Special Forums Cybersecurity Log remote execution over SSH
# 1  
Old 09-26-2011
Log remote execution over SSH

If a user execute commands remotely over ssh :
[user@remote ~] $ ssh USERNAME@SERVER COMMANDS

How the SERVER administrator can log those COMMANDS executed in a "not a tty" session ?

I searched for my question and get the following suggestions:
> as root, you could replace their shell with a simple wrapper script that logged their commands before passing them to the real shell. This would only work prior to them logging in.

We did this to monitor a hacked account at a previous employer. Created "/bin/bash " (notice the space) that was a wrapper around the script-command. Worked like a charm
Anybody give help how to do this ? what the content of "/bin/bash " ??!!

Krusty stated he had modified the /etc/profile to start "script"... here:
But I don't know how to do this ? I added "script" to /etc/profile, Nothing happen !

---------- Post updated 09-26-11 at 05:42 PM ---------- Previous update was 09-25-11 at 11:19 PM ----------

sorry, I confirm adding "script" to /etc/profile logs users commands in a normal session :
[user@remote ~] $ ssh USERNAME@SERVER

But this does not help logging remote commands execution mentioned here:
[user@remote ~] $ ssh USERNAME@SERVER COMMANDS

Any help how to :
Create "/bin/bash " (notice the space) that was a wrapper around the script-command ???
# 2  
Old 09-28-2011
if you want to monitor a users activity you should use the audit subsystem.
Login or Register to Ask a Question

Previous Thread | Next Thread

10 More Discussions You Might Find Interesting

1. Shell Programming and Scripting

Remote script over ssh execution issues.

If I execute below code I am able to get string from column8 and column10 about a process. serverA1$> ps -ef | grep rotate | grep 'config' | awk '{print $8" "$10}' /<Oracle_home>/ohs/bin/odl_rotatelogs -h:/<app_Home>/config/OHS/ohs1/component_events.xml_ohs1... (12 Replies)
Discussion started by: kchinnam
12 Replies

2. Shell Programming and Scripting

Pause processes in remote host and resume execution in another remote host

Hi, Given addresses of 2 remote machines, using a shell script is it possible to get the state of running processes in "src" stop all the processes in "src" exit out of "src" ssh into "dest" resume the state of executing processes captured in step 1 in "dest" Assumption: "src" is... (3 Replies)
Discussion started by: Saeya Darsan
3 Replies

3. HP-UX

Remote ssh execution and .profile issues

Greetings, i'm currently having issues in successfully executing a script from one server to other, and i'm cracking my nut in understanding why. Let's get started with the default info: Server A: briozzo@A:/home/briozzo $ uname -a HP-UX A B.11.31 U ia64 2787251109 unlimited-user license ... (3 Replies)
Discussion started by: nbriozzo
3 Replies

4. Solaris

how to login with ssh to remote system with out applying the remote root/usr password

how to login with ssh to remote system with out applying the remote root/user password with rlogin we can ujse .rhosts file but with ssh howits possible plz guide (2 Replies)
Discussion started by: tv.praveenkumar
2 Replies

5. Shell Programming and Scripting

Logging Remote SSH command (cannot log a java output)

Hi all I'm creating a script that runs a few commands on some boxes and everything can be logged EXCEPT the java -version command, there doesn't seem to be any output... Can anyone help explain why this does not work? Do I need to do something extra to append the output from the java... (3 Replies)
Discussion started by: Keepcase
3 Replies

6. Shell Programming and Scripting

help with remote execution of a script

does anyone know how can i execute a script which i locally run as " . /etc/local/host/src.srvr -D ." need to execute above command in rexec command. if i put the command as it is it does not run. Sorry but i am naive in scripting. Thanks rexec sgplqim -l vau -n ' ' (0 Replies)
Discussion started by: NK4U
0 Replies

7. Shell Programming and Scripting

ssh can't back from remote host during script execution

Hi all I wrote a script to execute a script on several remote hosts, but somehow during the execution of the local script, ssh can't come back from the remote host, so that causes my local script hanging... I use the below command to do the job in the local script, any idea? ssh... (12 Replies)
Discussion started by: bzylg
12 Replies

8. Shell Programming and Scripting

Remote command execution

We have multiple Unix servers and a particular command can only be executed in one of the box from a specific path. I have password-less ssh set up for all the boxes. I am unsure the command to use to execute that particular command from any other box. To be specific say program named _my_exe_ can... (4 Replies)
Discussion started by: uunniixx
4 Replies

9. AIX

remote execution

good morning I would like copy and execute a shell script on a remote server telnet is not autorize, so i use ssh: scp to copy and ssh to execute But with the scp, the permissions are not saved and the file 's permission on the remote server is r--r--r-- , so i can't execute it Can you help... (2 Replies)
Discussion started by: pascalbout
2 Replies

10. Shell Programming and Scripting

remote execution

Hi everybody, sorry if the question will be too trivial for some of you, but I'm not a unix shell programmer expert. I need to write a script that allows me to rlogin to another machine, check the load (cpu and mem usage) of the new machine, start a process (that will run in the background) and... (5 Replies)
Discussion started by: ragmelo
5 Replies
Login or Register to Ask a Question