Piping tcpdump traffic via SSH - but no root ssh access

Question

The situation

I would like to use Wireshark to analyze traffic on one of our servers, but I don't want to install Wireshark on the server itself. I understand that I can pipe tcpdump traffic via SSH to my local machine (Ubuntu) which has Wireshark installed.

The problem

I cannot login to the server with a root account because that is disabled. I have sudo rights, but when logged in to the server the command sudo tcpdump does not work. The command below (with or without sudo) won't work:

$ ssh [email protected] "sudo tcpdump -s 0 -U -n -w - -i eth0 not port 22" > /tmp/remote

The question

Is there a way to get this working? If so - how?

Answer 1

Without sudo the command doesn't have privileges to capture the device:

tcpdump: eth0: You don't have permission to capture on that device

But with sudo it would, but being run after ssh, it never gets password input for sudo on the remote server, so the solution is use -S (man sudo) and pipe password for sudo as follows:

ssh [email protected] "echo sudo_password | sudo -S tcpdump -s 0 -U -n -w - -i eth0 not port 22" > /tmp/remote"

On the one hand this is good for the automation with no getting sudo password promts and, to have completely automated code/script you would add sshpass -p password ssh....

However on the server where others can easily read your sudo password provided as open text during the ssh session that's not recommended from the security perspectives. So, to have a sudo with ssh and be safe use ssh -t

With -t it's impossible to pipe ssh "sudo command"| command for examplessh -t server "cd path/to/directory && sudo"|grep "text" but it IS possible with ussage of -S and echoing password, e.g. ssh server 'echo password | sudo -S ls -l'| grep 'a'

Answer 2

You can run this command via sudo on the server to capture the data first, and then send the resulting file back to your workstation to review the data

sudo tcpdump -i eth0 -s 65535 -w /tmp/wireshark