3

I'm going to allow a server administrator freelancer to access my server to do some tasks for me, so I want to save all the SSH commands that will be used in a file so I can access this file later and make sure that he didn't execute any malicious commands on my server.

I don't want the commands in this file to be deleted with the command (history -c), and also not to be deleted by ending the session.

3
  • 1
    What would be the point? If you give this person root access, they can undo anything you do and can find ways of getting around it. If you do not trust this person, you cannot really do anything about it.
    – terdon
    Dec 4, 2023 at 11:21
  • 1
    in place where auditing is mandatory, what your looking for is setup by a relay host, in which temporary admin have no privilege. he will sudo ssh target_host , sudo will log all to a file. You can also have a look at things like cyberark.
    – Archemar
    Dec 4, 2023 at 15:28
  • If you cannot afford a solution based on a relay host (@Archemar's idea above) then a similar local "ssh keylogger" started from authorized_keys would be acceptable. See this answer
    – xhienne
    Dec 4, 2023 at 21:36

1 Answer 1

3

Hi in order to do so (and even know who is doing any command as root with sudo) you can add in /etc/rsyslog.conf local6.* /var/log/commands.log then restart syslog service (it will add a logger called local6) and add in /etc/bashrc the following export PROMPT_COMMAND='RETRN_VAL=$?;logger -p local6.debug "$(whoami) [$$]: $(history 1 | sed "s/^[ ]*[0-9]\+[ ]*//" ) [$RETRN_VAL]"' which will call syslog service local6 to log the last line of history with the two users when sudo is used

3
  • That will only work if the user doesn't also set the PROMPT_COMMAND in their local files. Also, you probably want to add this to /etc/profile so you don't need to assume that the OP's machine has been set up to have /etc/profile source /etc/bash.bashrc, given that presumably we will be dealing with login shells.
    – terdon
    Dec 4, 2023 at 11:21
  • @terdon There are many ways to escape this and I don't think there is a bulletproof solution to the OP's problem. This one is a good-enough solution, though.
    – xhienne
    Dec 4, 2023 at 18:20
  • Oh it is indeed, @xhienne, and more than good enough! However, it does rely on having /etc/bash.bashrc sourced by /etc/profile and, as far as I know, that isn't standard, so I thought it worth mentioning. To be honest I think the whole thing is pointless since if this contractor has root access, they can do anything they want, but this is probably as close as the OP can get to a working solution.
    – terdon
    Dec 4, 2023 at 18:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .