I have a Linuxserver(CentOS) and many users can access this by ssh. I need to get all history commands from users:

  • Date: the time of execution
  • Pwd: executable directory
  • Remote host ip
  • User
  • Command

This question has a fairly complex answer because of the information you're looking for and because you didn't provide very much information (distribution of Linux, version, applications, use case).

You're going to need to combine at least two sets of logs (if not more) to be able to figure this out, and unless you write something custom to do it, it's going to take a lot of work to audit the system in this way on a daily, weekly, or even monthly basis. You'd be better off fixing any issues with your sudoers file and looking into how you should be controlling and auditing users than you should be looking at how you can find this information out after the fact.

/var/log/secure (RHEL/CentOS, /var/log/auth.log for Debian, changes depending on your distro and setup) should show you when people connected over SSH, and when they execute commands using sudo; using grep, you can find their IP, and from there, you can get a history of their connections:

grep '$USER_NAME' /var/log/secure

shows me an output like this (of course, santized):

Nov  1 22:38:41 $HOSTNAME sshd[26732]: Accepted publickey for $USERNAME from $IP_ADDRESS port 51203 ssh2: RSA $HASH
Nov  1 22:38:41 $HOSTNAME sshd[26732]: pam_unix(sshd:session): session opened for user $USERNAME by (uid=0)
Nov  1 22:38:41 $HOSTNAME systemd-logind[471]: New session 3427 of user $USERNAME.
Nov  1 22:38:41 $HOSTNAME systemd: pam_unix(systemd-user:session): session opened for user $USERNAME by (uid=0)
Nov  1 22:46:37 $HOSTNAME sudo:     $USERNAME : TTY=pts/0 ; PWD=$HOME ; USER=root ; COMMAND=/bin/grep $USERNAME /var/log/auth.log
Nov  1 22:46:37 $HOSTNAME sudo: pam_unix(sudo:session): session opened for user root by $USERNAME(uid=0)

So from the secure/auth log, I can already see the IP address, username, connection timestamp, all privileged commands executed by the user, and their timestamps.

You can see a full history of a users commands by replacing $USER_NAME with the user's username and executing this command, however, without timestamps. This will, inadvertently, show which directory they're in also.

su -c "history" $USER_NAME

shows me this from a user

500  exit
501  ls
502  cd Archive
503  ls
504  rm -rf *.NOTREAL
505  cd ../

I know that this person (actually me, getting real-world examples for this) executed command 501 when they first connected with SSH because exit is the command right before it (this is a bad indicator, because what if they timed out instead of using exit?), but once they connected, they moved into the Archive directory and removed all .NOTREAL files, then moved to the parent directory.

Based on what I find in the secure/auth log and the user's history, I can generally figure out what they did at what time, but it's a loose association. This becomes a lot harder if you have users doing things like connecting through ssh and then doing sudo su - or sudo -i to work as root in everything, since the historys are eventually combined.

If you really want to monitor things like this, then you really need to look at how you've set up privileged user accounts, your sudoers file, logging, and applications. I've given you a really rudimentary way of figuring this out, but it's far from the best way and it's far from usable on a regular basis in a real-world scenario.

  • Hi SSS, when I see the /var/log/secure file, there is only sudo cmd. How can I configure to get all cmd? – Võ Hoài Danh Nov 2 '18 at 6:01

Not the answer you're looking for? Browse other questions tagged or ask your own question.