I asked a question before, but I didn't get a satisfying answer in : How can I display ssh commands executed from another machine?

so I'll ask this time precisely.

How to display commands and their users/IP's, executed in my server via SSH. I'm looking to something like this :

#tail .bash_history : vi /etc/ssh/sshd_config : ls -l : cd .ssh : systemctl reload sshd.service : service --status-all etc...

  • 1
    You would need some shell logger to get all of that information. Bash is storing the history, but not the ip addresses. – Jakuje Mar 23 '17 at 13:02
  • rewrite bash to take $SSH_CONNECTION into account when writing .bash_history – Archemar Mar 23 '17 at 13:53
  • @Jakuje yes, but could change how to write this log. I added a this line export HISTTIMEFORMAT=$USER@$(hostname -I)" " to this file /etc/bash.bashrc , it didn't work of course. – zied Mar 24 '17 at 7:52
  • @Archemar $SSH_CONNECTION is a variable in the client's host only, not in the server. – zied Mar 24 '17 at 7:54
  • Try this document. It will be helpful for you. (askubuntu.com/questions/93566/…). – Sachin Aug 13 '18 at 5:32

Found the question interesting, so I googled a little, and find this.

More precisely, you need to add this line to your sshd_config.

ForceCommand logger -p user.notice "$SSH_ORIGINAL_COMMAND"

According to the man sshd_config:

Forces the execution of the command specified by ForceCommand, ignoring any command supplied by the client and ~/.ssh/rc if present. The command is invoked by using the user's login shell with the -c option. This applies to shell, command, or subsystem execution. It is most useful inside a Match block. The command originally supplied by the client is available in the SSH_ORIGINAL_COMMAND environment variable. Specifying a command of internal-sftp will force the use of an in-process SFTP server that requires no support files when used with ChrootDirectory. The default is none.

On my Debian rsyslog installation user.* is written to /var/log/user.log

Please note that the above will execute the logger command in-place of the original command. If you want to log the command and then execute it, you'd have to do something along the lines of (assuming bash is available as /bin/bash):

ForceCommand /bin/bash -rc 'logger -p user.notice "$SSH_ORIGINAL_COMMAND"; $SSH_ORIGINAL_COMMAND'

Or use a wrapper script which is even more restrictive than the restricted shell or - for interactive logins - the sshrc (/etc/ssh/sshrc) file could be another option to implement the logging.

  • I believe this exact command is going to make it impossible to execute the actual command, it will simply log it. You'd need a wrapper script for that. But it's useful nevertheless, so upvoted. – 0xC0000022L Oct 17 '20 at 19:51

Try this (https://askubuntu.com/questions/93566/how-to-log-all-bash-commands-by-all-users-on-a-server). Edit the /etc/bash.bashrc file and add the line

export PROMPT_COMMAND='RETRN_VAL=$?;logger -p local6.debug "$(whoami) [$$]: $(history 1 | sed "s/^[ ]*[0-9]\+[ ]*//" ) [$RETRN_VAL]"'

at bottom of the file and save it.

  • I've submitted an edit because you should use code highlighting to properly submit code snippets. Also, the final single quote seems to be missing. – Marki Feb 11 at 12:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.