Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 994
  • Last Modified:

Monitor CentOS root activity through SSH

Hello,

I have a contractor working on a server and using root access. Right now I have imperfect solution of using 'tail -f /root/.bash_history' > log.txt through ssh. I need to have a live streaming record of all system calls and terminal commands for the root activity on a remote server through ssh.

Thanks!
0
Sanction
Asked:
Sanction
1 Solution
 
Jan SpringerCommented:
Require that he use "sudo" and update the sudoers file to allow him to run any command as sudo root without requiring a password.  Identify the log file in sudoers to log all commands and be sure to create an exclusion where he cannot read or write to this log file.
0
 
Reza_aCommented:
You can enable audit, and then specify what sort of commands, system calls you need to log. There are some good commands for analysing those logs then.

But be aware that audit may generate huge log file depends on level that you are monitoring.
0
 
skullnobrainsCommented:
use the "ForceCommand" option in sshd_config to run a custom script that does what you expect or an existing tool such as rootsh.

if you redirect the output to an append-only file, or better a remote syslog, it will be quite difficult to bypass it without you noticing, even as root
0
 
SanctionAuthor Commented:
All good solutions! The only concern I have left is executing commands over ssh (ex. ssh user@server 'sudo bash -s' < local_script.sh) Any idea on how to restrict remote script execution and force the user to use shell to input all of the commands?
0
 
skullnobrainsCommented:
yes, use the "ForceCommand" option in ssh config file (see above)

also note that logging in sudo is absolutely trivial to bypass and is often bypassed accidentally by people who type "sudo sh" (which is roughly equivalent to "su") when they need to work as root so they just don't have to type sudo on evry line afterwards
0

Featured Post

Who's Defending Your Organization from Threats?

Protecting against advanced threats requires an IT dream team – a well-oiled machine of people and solutions working together to defend your organization. Download our resource kit today to learn more about the tools you need to build you IT Dream Team!

Tackle projects and never again get stuck behind a technical roadblock.
Join Now