I need to logging users that connected throw bastion host using proxycommand, I have used next command:

$ ssh -i ~/.ssh/key.pem user@ip -o "proxycommand ssh -W %h:%p user_bastio@bastion"

In the /var/log/auth.log:

Jun 18 10:44:29 bastio_host_name sshd[5064]: Accepted publickey for user_bastio from local_ip port 46806 ssh2: RSA SHA256:
Jun 18 10:44:29 bastion_host_name sshd[5064]: pam_unix(sshd:session): session opened for user user_bastio by (uid=0)
Jun 18 10:44:29 bastion_host_name systemd-logind[796]: New session 141521 of user user_bastio.

Also, I have added

export PROMPT_COMMAND='RETRN_VAL=$?;logger -p local6.debug "$SSH_CONNECTION $SSH_ORIGINAL_COMMAND $(whoami) [$$]: $(history 1 | sed "s/^[ ]*[0-9]$

to /etc/bash.bashrc , like in https://askubuntu.com/questions/93566/how-to-log-all-bash-commands-by-all-users-on-a-server , but there no commands that runs via proxycommand in /var/log/commands.log.

Is it possible to logging users and their commands that used proxycommand?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.