2

For some reason I can't see the command history log if someone ssh's into my account and runs some commands from my user account. If I run the history command in the terminal I only see my own commands that I have run. But not those of the person who ssh'ed into my account.

Is there a way to see what the person who ssh into my account is doing? What commands he is running from my account?

2
  • What makes you suspect someone logged into your account? Entries in wtmp? Files left over? Are you sure it's not e.g. a cron job?
    – RudiC
    Oct 27, 2018 at 16:36
  • If you are authenticating over ssh with public keys, you might try configuring the public key to execute a new bash session with a key specific history file... need to enable PermitUserEnvironment in /etc/ssh/sshd_config on the server and put environment="HISTFILE=~/.hist2" before the public key in the ~/.ssh/authorized_keys on the server. Oct 27, 2018 at 17:28

1 Answer 1

0

Is there a way to see what the person who ssh into my account is doing? What commands he is running from my account?

You can use sysdig to monitor the ssh session activity:

sudo sysdig -A -c echo_fds proc.name=sshd

The sysdig can write the event to a dump file e,g:

sudo sysdig -C 1 -w dump.scap

it can be reviewed and filtred to check the user activity:

sudo sysdig -r dump.scap0 -c spy_users

Sysdig Examples

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .