Solved

Monitor CentOS root activity through SSH

Posted on 2014-03-06
5
945 Views
Last Modified: 2014-03-14
Hello,

I have a contractor working on a server and using root access. Right now I have imperfect solution of using 'tail -f /root/.bash_history' > log.txt through ssh. I need to have a live streaming record of all system calls and terminal commands for the root activity on a remote server through ssh.

Thanks!
0
Comment
Question by:Sanction
5 Comments
 
LVL 28

Accepted Solution

by:
Jan Springer earned 500 total points
ID: 39910983
Require that he use "sudo" and update the sudoers file to allow him to run any command as sudo root without requiring a password.  Identify the log file in sudoers to log all commands and be sure to create an exclusion where he cannot read or write to this log file.
0
 
LVL 1

Expert Comment

by:Reza_a
ID: 39911051
You can enable audit, and then specify what sort of commands, system calls you need to log. There are some good commands for analysing those logs then.

But be aware that audit may generate huge log file depends on level that you are monitoring.
0
 
LVL 26

Expert Comment

by:skullnobrains
ID: 39912224
use the "ForceCommand" option in sshd_config to run a custom script that does what you expect or an existing tool such as rootsh.

if you redirect the output to an append-only file, or better a remote syslog, it will be quite difficult to bypass it without you noticing, even as root
0
 

Author Comment

by:Sanction
ID: 39914256
All good solutions! The only concern I have left is executing commands over ssh (ex. ssh user@server 'sudo bash -s' < local_script.sh) Any idea on how to restrict remote script execution and force the user to use shell to input all of the commands?
0
 
LVL 26

Expert Comment

by:skullnobrains
ID: 39928787
yes, use the "ForceCommand" option in ssh config file (see above)

also note that logging in sudo is absolutely trivial to bypass and is often bypassed accidentally by people who type "sudo sh" (which is roughly equivalent to "su") when they need to work as root so they just don't have to type sudo on evry line afterwards
0

Featured Post

What is SQL Server and how does it work?

The purpose of this paper is to provide you background on SQL Server. It’s your self-study guide for learning fundamentals. It includes both the history of SQL and its technical basics. Concepts and definitions will form the solid foundation of your future DBA expertise.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

If you use Debian 6 Squeeze and you are tired of looking at the childish graphical GDM login screen that is used by default, here's an easy way to change it. If you've already tried to change it you've probably discovered that none of the old met…
Note: for this to work properly you need to use a Cross-Over network cable. 1. Connect both servers S1 and S2 on the second network slots respectively. Note that you can use the 1st slots but usually these would be occupied by the Service Provide…
Windows 10 is mostly good. However the one thing that annoys me is how many clicks you have to do to dial a VPN connection. You have to go to settings from the start menu, (2 clicks), Network and Internet (1 click), Click VPN (another click) then fi…
A short tutorial showing how to set up an email signature in Outlook on the Web (previously known as OWA). For free email signatures designs, visit https://www.mail-signatures.com/articles/signature-templates/?sts=6651 If you want to manage em…

772 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question