How to capture ssh commands on the fly with auditd
1
There is any way to capture ssh commands on the fly, executed by an user with auditd? How to achieve this?
bash ssh linux-audit
asked 2 hours ago
JonLordJonLord
18810
add a comment |
1
There is any way to capture ssh commands on the fly, executed by an user with auditd? How to achieve this?
bash ssh linux-audit
asked 2 hours ago
JonLordJonLord
18810
unix.stackexchange.com/questions/350081/… shows the normal sysadmin way to do this. I do think it would be reasonable to be able to do it directly with auditd rules, but I'm not sure it can be done with the rules documented in my audit.rules(7) man page.
– Ed Grimm
2 hours ago
1
Hey @EdGrimm Thank you for your answer. The problem here is that I want to capture all the commands a user execute on a session in the moment that the command is executed. The logs generated in /var/log/audit/audit.log takes some time or wait for the client to finish the session.
– JonLord
1 hour ago
1
Yes, I understand - which is the only reason why I said I think it would be reasonable to do it directly with the auditd rules, rather than preferring to keep a security daemon simple. But you're right, it's probably better to be explicit, because last I checked, the vast majority of everyone are not me, and I expect that they're probably not you either. :)
– Ed Grimm
1 hour ago
Yep I agree with you. I am trying to do it with auditd rules but I'm not sure if it can be done too and I'm not having lucky. About your last statement I don't know if I understood what you mean, sorry about that :P
– JonLord
57 mins ago
That comment in less obtuse: Yes. I understood your motivation already, you understood your motivation, but it is important to communicate that to others. So thank you for making that clear. Sometimes I'm really bad at being clear.
– Ed Grimm
20 mins ago
add a comment |
1
1
1
There is any way to capture ssh commands on the fly, executed by an user with auditd? How to achieve this?
bash ssh linux-audit
asked 2 hours ago
JonLordJonLord
18810
There is any way to capture ssh commands on the fly, executed by an user with auditd? How to achieve this?
bash ssh linux-audit
bash ssh linux-audit
asked 2 hours ago
JonLordJonLord
18810
asked 2 hours ago
JonLordJonLord
18810
asked 2 hours ago
JonLordJonLord
18810
asked 2 hours ago
JonLordJonLord
18810
asked 2 hours ago
JonLordJonLord
18810
18810
unix.stackexchange.com/questions/350081/… shows the normal sysadmin way to do this. I do think it would be reasonable to be able to do it directly with auditd rules, but I'm not sure it can be done with the rules documented in my audit.rules(7) man page.
– Ed Grimm
2 hours ago
1
Hey @EdGrimm Thank you for your answer. The problem here is that I want to capture all the commands a user execute on a session in the moment that the command is executed. The logs generated in /var/log/audit/audit.log takes some time or wait for the client to finish the session.
– JonLord
1 hour ago
1
Yes, I understand - which is the only reason why I said I think it would be reasonable to do it directly with the auditd rules, rather than preferring to keep a security daemon simple. But you're right, it's probably better to be explicit, because last I checked, the vast majority of everyone are not me, and I expect that they're probably not you either. :)
– Ed Grimm
1 hour ago
Yep I agree with you. I am trying to do it with auditd rules but I'm not sure if it can be done too and I'm not having lucky. About your last statement I don't know if I understood what you mean, sorry about that :P
– JonLord
57 mins ago
That comment in less obtuse: Yes. I understood your motivation already, you understood your motivation, but it is important to communicate that to others. So thank you for making that clear. Sometimes I'm really bad at being clear.
– Ed Grimm
20 mins ago
add a comment |
unix.stackexchange.com/questions/350081/… shows the normal sysadmin way to do this. I do think it would be reasonable to be able to do it directly with auditd rules, but I'm not sure it can be done with the rules documented in my audit.rules(7) man page.
– Ed Grimm
2 hours ago
1
Hey @EdGrimm Thank you for your answer. The problem here is that I want to capture all the commands a user execute on a session in the moment that the command is executed. The logs generated in /var/log/audit/audit.log takes some time or wait for the client to finish the session.
– JonLord
1 hour ago
1
Yes, I understand - which is the only reason why I said I think it would be reasonable to do it directly with the auditd rules, rather than preferring to keep a security daemon simple. But you're right, it's probably better to be explicit, because last I checked, the vast majority of everyone are not me, and I expect that they're probably not you either. :)
– Ed Grimm
1 hour ago
Yep I agree with you. I am trying to do it with auditd rules but I'm not sure if it can be done too and I'm not having lucky. About your last statement I don't know if I understood what you mean, sorry about that :P
– JonLord
57 mins ago
That comment in less obtuse: Yes. I understood your motivation already, you understood your motivation, but it is important to communicate that to others. So thank you for making that clear. Sometimes I'm really bad at being clear.
– Ed Grimm
20 mins ago
unix.stackexchange.com/questions/350081/… shows the normal sysadmin way to do this. I do think it would be reasonable to be able to do it directly with auditd rules, but I'm not sure it can be done with the rules documented in my audit.rules(7) man page.
– Ed Grimm
2 hours ago
unix.stackexchange.com/questions/350081/… shows the normal sysadmin way to do this. I do think it would be reasonable to be able to do it directly with auditd rules, but I'm not sure it can be done with the rules documented in my audit.rules(7) man page.
– Ed Grimm
2 hours ago
1
1
Hey @EdGrimm Thank you for your answer. The problem here is that I want to capture all the commands a user execute on a session in the moment that the command is executed. The logs generated in /var/log/audit/audit.log takes some time or wait for the client to finish the session.
– JonLord
1 hour ago
Hey @EdGrimm Thank you for your answer. The problem here is that I want to capture all the commands a user execute on a session in the moment that the command is executed. The logs generated in /var/log/audit/audit.log takes some time or wait for the client to finish the session.
– JonLord
1 hour ago
1
1
Yes, I understand - which is the only reason why I said I think it would be reasonable to do it directly with the auditd rules, rather than preferring to keep a security daemon simple. But you're right, it's probably better to be explicit, because last I checked, the vast majority of everyone are not me, and I expect that they're probably not you either. :)
– Ed Grimm
1 hour ago
Yes, I understand - which is the only reason why I said I think it would be reasonable to do it directly with the auditd rules, rather than preferring to keep a security daemon simple. But you're right, it's probably better to be explicit, because last I checked, the vast majority of everyone are not me, and I expect that they're probably not you either. :)
– Ed Grimm
1 hour ago
Yep I agree with you. I am trying to do it with auditd rules but I'm not sure if it can be done too and I'm not having lucky. About your last statement I don't know if I understood what you mean, sorry about that :P
– JonLord
57 mins ago
Yep I agree with you. I am trying to do it with auditd rules but I'm not sure if it can be done too and I'm not having lucky. About your last statement I don't know if I understood what you mean, sorry about that :P
– JonLord
57 mins ago
That comment in less obtuse: Yes. I understood your motivation already, you understood your motivation, but it is important to communicate that to others. So thank you for making that clear. Sometimes I'm really bad at being clear.
– Ed Grimm
20 mins ago
That comment in less obtuse: Yes. I understood your motivation already, you understood your motivation, but it is important to communicate that to others. So thank you for making that clear. Sometimes I'm really bad at being clear.
– Ed Grimm
20 mins ago
add a comment |
0
active
oldest
votes
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "106"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
draft saved
draft discarded
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f501764%2fhow-to-capture-ssh-commands-on-the-fly-with-auditd%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
0
active
oldest
votes
0
active
oldest
votes
active
oldest
votes
active
oldest
votes
draft saved
draft discarded
Thanks for contributing an answer to Unix & Linux Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
draft saved
draft discarded
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f501764%2fhow-to-capture-ssh-commands-on-the-fly-with-auditd%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
unix.stackexchange.com/questions/350081/… shows the normal sysadmin way to do this. I do think it would be reasonable to be able to do it directly with auditd rules, but I'm not sure it can be done with the rules documented in my audit.rules(7) man page.
– Ed Grimm
2 hours ago
1
Hey @EdGrimm Thank you for your answer. The problem here is that I want to capture all the commands a user execute on a session in the moment that the command is executed. The logs generated in /var/log/audit/audit.log takes some time or wait for the client to finish the session.
– JonLord
1 hour ago
1
Yes, I understand - which is the only reason why I said I think it would be reasonable to do it directly with the auditd rules, rather than preferring to keep a security daemon simple. But you're right, it's probably better to be explicit, because last I checked, the vast majority of everyone are not me, and I expect that they're probably not you either. :)
– Ed Grimm
1 hour ago
Yep I agree with you. I am trying to do it with auditd rules but I'm not sure if it can be done too and I'm not having lucky. About your last statement I don't know if I understood what you mean, sorry about that :P
– JonLord
57 mins ago
That comment in less obtuse: Yes. I understood your motivation already, you understood your motivation, but it is important to communicate that to others. So thank you for making that clear. Sometimes I'm really bad at being clear.
– Ed Grimm
20 mins ago