I am writing because I need a way to monitor what my users send via ssh.
I have a jumphost and I tried the following:
both system-auth and password-auth have the corresponding:
session required pam_tty_audit.so enable=*
With no success, so I tried adding some specific system calls to monitor what is being sent, specifically with execve via auditd
-a always,exit -F arch=b64 -S execve -a always,exit -F arch=b32 -S execve -w /bin/sudo -p x -w /bin/ssh -p x -w /bin/scp -p x -w /bin/vi -p x -a always,exit -F arch=b64 -S open`
I took a look at the openssh code repository in git and noticed this in the commit notes:
auth-pam.c Remove do_pam_set_tty which is dead code. auth-pam.h Remove do_pam_set_tty which is dead code.
So I wondered if this was a depreciated functionality.
At any rate, besides "shell hacks" which can be circumvented by users fairly easily...
Is there any method viable by which I can see what is being sent to a remote host? It seems that the majority of threads that I have found on the topic seem to focus on logging who logged into what, when. I want to see what the user sent to the remote tty/pts from my jumphost which is facilitating the ssh connection.
Thanks for any and all suggestions.