2

I am writing because I need a way to monitor what my users send via ssh.

I have a jumphost and I tried the following:

https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Security_Guide/sec-Configuring_PAM_for_Auditing.html

both system-auth and password-auth have the corresponding:

session     required      pam_tty_audit.so enable=*

With no success, so I tried adding some specific system calls to monitor what is being sent, specifically with execve via auditd

-a always,exit -F arch=b64 -S execve
-a always,exit -F arch=b32 -S execve
-w /bin/sudo -p x
-w /bin/ssh -p x
-w /bin/scp -p x
-w /bin/vi -p x
-a always,exit -F arch=b64 -S open`

I took a look at the openssh code repository in git and noticed this in the commit notes:

auth-pam.c  Remove do_pam_set_tty which is dead code.   
auth-pam.h  Remove do_pam_set_tty which is dead code. 

So I wondered if this was a depreciated functionality.

At any rate, besides "shell hacks" which can be circumvented by users fairly easily...

Is there any method viable by which I can see what is being sent to a remote host? It seems that the majority of threads that I have found on the topic seem to focus on logging who logged into what, when. I want to see what the user sent to the remote tty/pts from my jumphost which is facilitating the ssh connection.

Thanks for any and all suggestions.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.