There is any way to capture ssh commands executed by an user, on the fly with auditd?
The image exemplifies a case where a user send a command and auditd capture the command in execution time. At this time a script could decide if the command is allowed or the command needs to be blocked
I tried to edit
session required pam_tty_audit.so enable=*
The problem here is that auditd capture the commands and log then with a big delay or after the user logout.
I believe that if I use auditd rules It can be possible but I don't know how. I accept other approaches and other packages (preferably standard on Debian)
Edit: I could capture the commands using strace by identifying the ssh process pid and listening to stdin but I don't know how to automate this since every new connection will have different pids.