Can administrators know what commands I execute non-interactively through SSH?
For example: does echo hello
get logged somewhere at remote
if I run this?
$ ssh me@remote "echo hello"
Can remote commands be otherwise monitored?
Can administrators know what commands I execute non-interactively through SSH?
For example: does echo hello
get logged somewhere at remote
if I run this?
$ ssh me@remote "echo hello"
Can remote commands be otherwise monitored?
The administrator could install a modified sshd that records everything from all ssh sessions, interactive or not.
The question is: Do you trust the administrator of the remote system?
sshd
servers don't record non-interactive sections, right?
– n.r.
Jul 3 '13 at 12:18
sshd_config
, again, doesn't mention this: "LogLevel Gives the verbosity level that is used when logging messages from ssh(1). The possible values are: QUIET, FATAL, ERROR, INFO, VERBOSE, DEBUG, DEBUG1, DEBUG2, and DEBUG3. The default is INFO. DEBUG and DEBUG1 are equivalent. DEBUG2 and DEBUG3 each specify higher levels of verbose output."
– n.r.
Jul 3 '13 at 17:20
If you want to hide the command from the ps list, eg a password, encapsulate it into a script, then copy the script over and execute it.
cat > blah.sh << EOF
#!/bin/bash
some
commands
here
EOF
scp blah.sh targethost:~
ssh targethost ./blah.sh
This would also prevent any finagling that eg records all commands run. Anyone monitoring would just know that 'blah.sh' was run, not what was in it. Assuming you remove it afterwards.
sshd
, but if he is malicious and/or paranoid, he could also simply replace sshd
with something else entirely.
– tripleee
Jul 3 '13 at 3:42
Yes, It is possible. there are several ways to do this. you can simply record a session by using script
command. There are several commercial tools such as observeit to get lot more detail.
I think depending on a setup a user can be restricted to figure out if their session been recorded either non-interactive or interactive.
Yes. On the remote host its recorded on /var/log/secure. You'll need sudo to view this log file.