There is any way to capture ssh commands executed by an user, on the fly with auditd?

The image exemplifies a case where a user send a command and auditd capture the command in execution time. At this time a script could decide if the command is allowed or the command needs to be blocked

I tried to edit /etc/pam.d/sshd adding

session required pam_tty_audit.so enable=*

The problem here is that auditd capture the commands and log then with a big delay or after the user logout.

I believe that if I use auditd rules It can be possible but I don't know how. I accept other approaches and other packages (preferably standard on Debian)

Edit: I could capture the commands using strace by identifying the ssh process pid and listening to stdin but I don't know how to automate this since every new connection will have different pids.

  • unix.stackexchange.com/questions/350081/… shows the normal sysadmin way to do this. I do think it would be reasonable to be able to do it directly with auditd rules, but I'm not sure it can be done with the rules documented in my audit.rules(7) man page. – Ed Grimm Feb 20 at 4:24
  • 1
    Hey @EdGrimm Thank you for your answer. The problem here is that I want to capture all the commands a user execute on a session in the moment that the command is executed. The logs generated in /var/log/audit/audit.log takes some time or wait for the client to finish the session. – JonLord Feb 20 at 5:18
  • 1
    Yes, I understand - which is the only reason why I said I think it would be reasonable to do it directly with the auditd rules, rather than preferring to keep a security daemon simple. But you're right, it's probably better to be explicit, because last I checked, the vast majority of everyone are not me, and I expect that they're probably not you either. :) – Ed Grimm Feb 20 at 5:23
  • Yep I agree with you. I am trying to do it with auditd rules but I'm not sure if it can be done too and I'm not having lucky. About your last statement I don't know if I understood what you mean, sorry about that :P – JonLord Feb 20 at 5:36
  • 1
    That comment in less obtuse: Yes. I understood your motivation already, you understood your motivation, but it is important to communicate that to others. So thank you for making that clear. Sometimes I'm really bad at being clear. – Ed Grimm Feb 20 at 6:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.