Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #192682

Re: SSH session audit

Show all headers | View raw

On 2/19/2018 1:51 PM, me@risca.eu wrote:
> Hi,
> 
> I'm co-managing a server with a friend of mine offering ourself some 
> basic service (like emails, file sharing, etc). At this time each of us 
> can freely login on the server via ssh (we trust each others) for the 
> daily administrative tasks.
> 
> I would like to improve the current set up by adding a layer of 
> certification and proofing of the ssh session, because if you know that 
> you are recorded you'll be enforce to behave better. For this scope I've 
> found many different possible solution, but quite complex to be 
> implemented (like ssh proxy that records the session [1]), or too basic 
> (like using /usr/bin/script). So far none of those that I've found 
> satisfy me.
> 
> About that I remember that some time ago (maybe one or two years ago) I 
> read a post on planet debian about such a method for session audit. It 
> was suggesting as an easy to run solution for external consultant: the 
> recording and encrypting of the remote session was performed without 
> requiring any proxy, letting to store the session data on a dumb 
> external host. From what I could remember I think that the idea was 
> something like recording the session with script like utilities 
> (launched at session login), then periodically encrypting it with gpg 
> and publishing on a local folder or on a remote resource. This way the 
> owner of the system could reliably access the session log, and the 
> remote person could always prove what he did at during the ssh session.
> 
> Do you know about that solution? Or could you suggest something similar?
> 
> Thank you,
> 
> risca.
> 
> [1] ssh proxy solutions: ssh-bastion, KeyBox
> 

Isn't pam enough?:

https://linux.die.net/man/8/pam

No need to install anything and it's quite versatile.

-- 
John Doe

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

SSH session audit me@risca.eu - 2018-02-19 14:10 +0100
  Re: SSH session audit Eero Volotinen <eero.volotinen@iki.fi> - 2018-02-19 14:20 +0100
    Re: SSH session audit me@risca.eu - 2018-02-19 14:40 +0100
      Re: SSH session audit Eero Volotinen <eero.volotinen@iki.fi> - 2018-02-19 14:50 +0100
  Re: SSH session audit Steve Kemp <steve@steve.org.uk> - 2018-02-19 14:50 +0100
  Re: SSH session audit john doe <johndoe65534@mail.com> - 2018-02-19 17:00 +0100
    Re: SSH session audit me@risca.eu - 2018-02-19 17:30 +0100
      Re: SSH session audit Eero Volotinen <eero.volotinen@iki.fi> - 2018-02-19 17:40 +0100
      Re: SSH session audit Roberto C. Sánchez <roberto@debian.org> - 2018-02-19 17:40 +0100
  Re: SSH session audit David Christensen <dpchrist@holgerdanske.com> - 2018-02-19 22:40 +0100

csiph-web