Can administrators know what commands I execute non-interactively through SSH?
For example: does echo hello get logged somewhere at remote if I run this?
$ ssh me@remote "echo hello"
Can remote commands be otherwise monitored?
4
2
The administrator could install a modified sshd that records everything from all ssh sessions, interactive or not.
The question is: Do you trust the administrator of the remote system?
-
Not much. So, vanilla
sshdservers don't record non-interactive sections, right? – n.r. Jul 3 '13 at 12:18 -
2Vanilla sshd can be set to log at a DEBUG level and according to the man page "Logging with a DEBUG level violates the privacy of users ..." – Craig Jul 3 '13 at 13:37
-
Oops, its actually the sshd_config man page for the "LogLevel" directive. – Craig Jul 3 '13 at 17:06
-
Thanks for checking! I trust you but my
sshd_config, again, doesn't mention this: "LogLevel Gives the verbosity level that is used when logging messages from ssh(1). The possible values are: QUIET, FATAL, ERROR, INFO, VERBOSE, DEBUG, DEBUG1, DEBUG2, and DEBUG3. The default is INFO. DEBUG and DEBUG1 are equivalent. DEBUG2 and DEBUG3 each specify higher levels of verbose output." – n.r. Jul 3 '13 at 17:20 -
Even if your man page doesn't include the warning I suspect the warning is still valid. – Craig Jul 3 '13 at 17:27
1
If you want to hide the command from the ps list, eg a password, encapsulate it into a script, then copy the script over and execute it.
cat > blah.sh << EOF
#!/bin/bash
some
commands
here
EOF
scp blah.sh targethost:~
ssh targethost ./blah.sh
This would also prevent any finagling that eg records all commands run. Anyone monitoring would just know that 'blah.sh' was run, not what was in it. Assuming you remove it afterwards.
-
This covers the scenario where e.g. an admin had tweaked up the debug level of
sshd, but if he is malicious and/or paranoid, he could also simply replacesshdwith something else entirely. – tripleee Jul 3 '13 at 3:42
0
Yes, It is possible. there are several ways to do this. you can simply record a session by using script command. There are several commercial tools such as observeit to get lot more detail.
I think depending on a setup a user can be restricted to figure out if their session been recorded either non-interactive or interactive.
-
Yep. But I don't want to record my own session. I'd like to know whether someone else can record or log a non-interactive SSH session that I started. – n.r. Jul 2 '13 at 21:02
-3
Yes. On the remote host its recorded on /var/log/secure. You'll need sudo to view this log file.
-
-1 This answer is not generally true. Perhaps add information about which platform(s) or distribution(s) this applies to. – tripleee Jul 3 '13 at 3:40
