viewing ssh traffic

Rayne · Tux's lil' helper Joined: 30 May 2005 Posts: 131

How can I view who's doing what on my sshd?

Dammital · Apprentice Joined: 05 Nov 2004 Posts: 189

You can't see into the ssh session of course. Consider enabling "BSD process accounting" in your kernel config, and then emerge acct. This will give you the tools to keep and report on a per-process log file.

feld · Guru Joined: 29 Aug 2004 Posts: 593 Location: USA

w and who will show you who is in at least.... combine with their info from there and output from ps you can get a good idea of what they're running
_________________
< bmg505> I think the first line in reiserfsck is

if (random(65535)< 65500) { hose(partition); for (i=0;i<100000000;i++) print_crap(); }

shanew · n00b Joined: 16 Sep 2006 Posts: 34 Location: Austin, TX

I would second the use of process accounting, which is useful for other reasons as well.

There are also programs that will allow you to watch or snoop on terminal sessions, which would allow you to see exactly what users are typing and seeing in real-time, but they may require modification to the sshd code to work properly (and some used to require modifications to kernel code as well). There are, of course, some pretty serious privacy, security and ethical issues involved in this level of surveillance, and if you're looking to do this in any official organization, such a setup should be approved by management, spelled out in policy, and made clear to users.