How to capture ssh commands on the fly with auditd
Clash Royale CLAN TAG#URR8PPP
There is any way to capture ssh commands executed by an user, on the fly with auditd?
The image exemplifies a case where a user send a command and auditd capture the command in execution time. At this time a script could decide if the command is allowed or the command needs to be blocked
I tried to edit /etc/pam.d/sshd adding
session required pam_tty_audit.so enable=*
The problem here is that auditd capture the commands and log then with a big delay or after the user logout.
I believe that if I use auditd rules It can be possible but I don't know how. I accept other approaches and other packages (preferably standard on Debian)
Edit: I could capture the commands using strace by identifying the ssh process pid and listening to stdin but I don't know how to automate this since every new connection will have different pids.
bash ssh linux-audit
asked Feb 20 at 4:03
JonLordJonLord
19611
add a comment |
There is any way to capture ssh commands executed by an user, on the fly with auditd?
The image exemplifies a case where a user send a command and auditd capture the command in execution time. At this time a script could decide if the command is allowed or the command needs to be blocked
I tried to edit /etc/pam.d/sshd adding
session required pam_tty_audit.so enable=*
The problem here is that auditd capture the commands and log then with a big delay or after the user logout.
I believe that if I use auditd rules It can be possible but I don't know how. I accept other approaches and other packages (preferably standard on Debian)
Edit: I could capture the commands using strace by identifying the ssh process pid and listening to stdin but I don't know how to automate this since every new connection will have different pids.
bash ssh linux-audit
asked Feb 20 at 4:03
JonLordJonLord
19611
unix.stackexchange.com/questions/350081/… shows the normal sysadmin way to do this. I do think it would be reasonable to be able to do it directly with auditd rules, but I'm not sure it can be done with the rules documented in my audit.rules(7) man page.
– Ed Grimm
Feb 20 at 4:24
1
Hey @EdGrimm Thank you for your answer. The problem here is that I want to capture all the commands a user execute on a session in the moment that the command is executed. The logs generated in /var/log/audit/audit.log takes some time or wait for the client to finish the session.
– JonLord
Feb 20 at 5:18
1
Yes, I understand - which is the only reason why I said I think it would be reasonable to do it directly with the auditd rules, rather than preferring to keep a security daemon simple. But you're right, it's probably better to be explicit, because last I checked, the vast majority of everyone are not me, and I expect that they're probably not you either. :)
– Ed Grimm
Feb 20 at 5:23
Yep I agree with you. I am trying to do it with auditd rules but I'm not sure if it can be done too and I'm not having lucky. About your last statement I don't know if I understood what you mean, sorry about that :P
– JonLord
Feb 20 at 5:36
1
That comment in less obtuse: Yes. I understood your motivation already, you understood your motivation, but it is important to communicate that to others. So thank you for making that clear. Sometimes I'm really bad at being clear.
– Ed Grimm
Feb 20 at 6:12
add a comment |
There is any way to capture ssh commands executed by an user, on the fly with auditd?
The image exemplifies a case where a user send a command and auditd capture the command in execution time. At this time a script could decide if the command is allowed or the command needs to be blocked
I tried to edit /etc/pam.d/sshd adding
session required pam_tty_audit.so enable=*
The problem here is that auditd capture the commands and log then with a big delay or after the user logout.
I believe that if I use auditd rules It can be possible but I don't know how. I accept other approaches and other packages (preferably standard on Debian)
Edit: I could capture the commands using strace by identifying the ssh process pid and listening to stdin but I don't know how to automate this since every new connection will have different pids.
bash ssh linux-audit
asked Feb 20 at 4:03
JonLordJonLord
19611
There is any way to capture ssh commands executed by an user, on the fly with auditd?
The image exemplifies a case where a user send a command and auditd capture the command in execution time. At this time a script could decide if the command is allowed or the command needs to be blocked
I tried to edit /etc/pam.d/sshd adding
session required pam_tty_audit.so enable=*
The problem here is that auditd capture the commands and log then with a big delay or after the user logout.
I believe that if I use auditd rules It can be possible but I don't know how. I accept other approaches and other packages (preferably standard on Debian)
Edit: I could capture the commands using strace by identifying the ssh process pid and listening to stdin but I don't know how to automate this since every new connection will have different pids.
bash ssh linux-audit
bash ssh linux-audit
asked Feb 20 at 4:03
JonLordJonLord
19611
asked Feb 20 at 4:03
JonLordJonLord
19611
edited Feb 23 at 23:55
JonLord
asked Feb 20 at 4:03
JonLordJonLord
19611
asked Feb 20 at 4:03
JonLordJonLord
19611
asked Feb 20 at 4:03
JonLordJonLord
19611
19611
unix.stackexchange.com/questions/350081/… shows the normal sysadmin way to do this. I do think it would be reasonable to be able to do it directly with auditd rules, but I'm not sure it can be done with the rules documented in my audit.rules(7) man page.
– Ed Grimm
Feb 20 at 4:24
1
Hey @EdGrimm Thank you for your answer. The problem here is that I want to capture all the commands a user execute on a session in the moment that the command is executed. The logs generated in /var/log/audit/audit.log takes some time or wait for the client to finish the session.
– JonLord
Feb 20 at 5:18
1
Yes, I understand - which is the only reason why I said I think it would be reasonable to do it directly with the auditd rules, rather than preferring to keep a security daemon simple. But you're right, it's probably better to be explicit, because last I checked, the vast majority of everyone are not me, and I expect that they're probably not you either. :)
– Ed Grimm
Feb 20 at 5:23
Yep I agree with you. I am trying to do it with auditd rules but I'm not sure if it can be done too and I'm not having lucky. About your last statement I don't know if I understood what you mean, sorry about that :P
– JonLord
Feb 20 at 5:36
1
That comment in less obtuse: Yes. I understood your motivation already, you understood your motivation, but it is important to communicate that to others. So thank you for making that clear. Sometimes I'm really bad at being clear.
– Ed Grimm
Feb 20 at 6:12
add a comment |
unix.stackexchange.com/questions/350081/… shows the normal sysadmin way to do this. I do think it would be reasonable to be able to do it directly with auditd rules, but I'm not sure it can be done with the rules documented in my audit.rules(7) man page.
– Ed Grimm
Feb 20 at 4:24
1
Hey @EdGrimm Thank you for your answer. The problem here is that I want to capture all the commands a user execute on a session in the moment that the command is executed. The logs generated in /var/log/audit/audit.log takes some time or wait for the client to finish the session.
– JonLord
Feb 20 at 5:18
1
Yes, I understand - which is the only reason why I said I think it would be reasonable to do it directly with the auditd rules, rather than preferring to keep a security daemon simple. But you're right, it's probably better to be explicit, because last I checked, the vast majority of everyone are not me, and I expect that they're probably not you either. :)
– Ed Grimm
Feb 20 at 5:23
Yep I agree with you. I am trying to do it with auditd rules but I'm not sure if it can be done too and I'm not having lucky. About your last statement I don't know if I understood what you mean, sorry about that :P
– JonLord
Feb 20 at 5:36
1
That comment in less obtuse: Yes. I understood your motivation already, you understood your motivation, but it is important to communicate that to others. So thank you for making that clear. Sometimes I'm really bad at being clear.
– Ed Grimm
Feb 20 at 6:12
unix.stackexchange.com/questions/350081/… shows the normal sysadmin way to do this. I do think it would be reasonable to be able to do it directly with auditd rules, but I'm not sure it can be done with the rules documented in my audit.rules(7) man page.
– Ed Grimm
Feb 20 at 4:24
unix.stackexchange.com/questions/350081/… shows the normal sysadmin way to do this. I do think it would be reasonable to be able to do it directly with auditd rules, but I'm not sure it can be done with the rules documented in my audit.rules(7) man page.
– Ed Grimm
Feb 20 at 4:24
1
1
Hey @EdGrimm Thank you for your answer. The problem here is that I want to capture all the commands a user execute on a session in the moment that the command is executed. The logs generated in /var/log/audit/audit.log takes some time or wait for the client to finish the session.
– JonLord
Feb 20 at 5:18
Hey @EdGrimm Thank you for your answer. The problem here is that I want to capture all the commands a user execute on a session in the moment that the command is executed. The logs generated in /var/log/audit/audit.log takes some time or wait for the client to finish the session.
– JonLord
Feb 20 at 5:18
1
1
Yes, I understand - which is the only reason why I said I think it would be reasonable to do it directly with the auditd rules, rather than preferring to keep a security daemon simple. But you're right, it's probably better to be explicit, because last I checked, the vast majority of everyone are not me, and I expect that they're probably not you either. :)
– Ed Grimm
Feb 20 at 5:23
Yes, I understand - which is the only reason why I said I think it would be reasonable to do it directly with the auditd rules, rather than preferring to keep a security daemon simple. But you're right, it's probably better to be explicit, because last I checked, the vast majority of everyone are not me, and I expect that they're probably not you either. :)
– Ed Grimm
Feb 20 at 5:23
Yep I agree with you. I am trying to do it with auditd rules but I'm not sure if it can be done too and I'm not having lucky. About your last statement I don't know if I understood what you mean, sorry about that :P
– JonLord
Feb 20 at 5:36
Yep I agree with you. I am trying to do it with auditd rules but I'm not sure if it can be done too and I'm not having lucky. About your last statement I don't know if I understood what you mean, sorry about that :P
– JonLord
Feb 20 at 5:36
1
1
That comment in less obtuse: Yes. I understood your motivation already, you understood your motivation, but it is important to communicate that to others. So thank you for making that clear. Sometimes I'm really bad at being clear.
– Ed Grimm
Feb 20 at 6:12
That comment in less obtuse: Yes. I understood your motivation already, you understood your motivation, but it is important to communicate that to others. So thank you for making that clear. Sometimes I'm really bad at being clear.
– Ed Grimm
Feb 20 at 6:12
add a comment |
0
active
oldest
votes
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "106"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f501764%2fhow-to-capture-ssh-commands-on-the-fly-with-auditd%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
0
active
oldest
votes
0
active
oldest
votes
active
oldest
votes
active
oldest
votes
Thanks for contributing an answer to Unix & Linux Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f501764%2fhow-to-capture-ssh-commands-on-the-fly-with-auditd%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
unix.stackexchange.com/questions/350081/… shows the normal sysadmin way to do this. I do think it would be reasonable to be able to do it directly with auditd rules, but I'm not sure it can be done with the rules documented in my audit.rules(7) man page.
– Ed Grimm
Feb 20 at 4:24
1
Hey @EdGrimm Thank you for your answer. The problem here is that I want to capture all the commands a user execute on a session in the moment that the command is executed. The logs generated in /var/log/audit/audit.log takes some time or wait for the client to finish the session.
– JonLord
Feb 20 at 5:18
1
Yes, I understand - which is the only reason why I said I think it would be reasonable to do it directly with the auditd rules, rather than preferring to keep a security daemon simple. But you're right, it's probably better to be explicit, because last I checked, the vast majority of everyone are not me, and I expect that they're probably not you either. :)
– Ed Grimm
Feb 20 at 5:23
Yep I agree with you. I am trying to do it with auditd rules but I'm not sure if it can be done too and I'm not having lucky. About your last statement I don't know if I understood what you mean, sorry about that :P
– JonLord
Feb 20 at 5:36
1
That comment in less obtuse: Yes. I understood your motivation already, you understood your motivation, but it is important to communicate that to others. So thank you for making that clear. Sometimes I'm really bad at being clear.
– Ed Grimm
Feb 20 at 6:12