I asked a question before, but I didn't get a satisfying answer in : How can I display ssh commands executed from another machine?

so I'll ask this time precisely.

How to display commands and their users/IP's, executed in my server via SSH. I'm looking to something like this :

#tail .bash_history : vi /etc/ssh/sshd_config : ls -l : cd .ssh : systemctl reload sshd.service : service --status-all etc...

  • 1
    You would need some shell logger to get all of that information. Bash is storing the history, but not the ip addresses. – Jakuje Mar 23 '17 at 13:02
  • rewrite bash to take $SSH_CONNECTION into account when writing .bash_history – Archemar Mar 23 '17 at 13:53
  • @Jakuje yes, but could change how to write this log. I added a this line export HISTTIMEFORMAT=$USER@$(hostname -I)" " to this file /etc/bash.bashrc , it didn't work of course. – zied Mar 24 '17 at 7:52
  • @Archemar $SSH_CONNECTION is a variable in the client's host only, not in the server. – zied Mar 24 '17 at 7:54
  • Try this document. It will be helpful for you. (askubuntu.com/questions/93566/…). – Sachin Aug 13 '18 at 5:32

Found the question interesting, so I googled a little, and find this.

More precisely, you need to add this line to your sshd_config.

ForceCommand logger -p user.notice "$SSH_ORIGINAL_COMMAND"

According to the man sshd_config:

Forces the execution of the command specified by ForceCommand, ignoring any command supplied by the client and ~/.ssh/rc if present. The command is invoked by using the user's login shell with the -c option. This applies to shell, command, or subsystem execution. It is most useful inside a Match block. The command originally supplied by the client is available in the SSH_ORIGINAL_COMMAND environment variable. Specifying a command of internal-sftp will force the use of an in-process SFTP server that requires no support files when used with ChrootDirectory. The default is none.

On my debian rsyslog installation user.* is written to /var/log/user.log


Try this (https://askubuntu.com/questions/93566/how-to-log-all-bash-commands-by-all-users-on-a-server). Just edit the /etc/bash.bashrc file and add the line export PROMPT_COMMAND='RETRN_VAL=$?;logger -p local6.debug "$(whoami) [$$]: $(history 1 | sed "s/^[ ][0-9]+[ ]//" ) [$RETRN_VAL]" at bottom of the file and save it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.