2

For some reason I can't see the command history log if someone ssh's into my account and runs some commands from my user account. If I run the history command in the terminal I only see my own commands that I have run. But not those of the person who ssh'ed into my account.

Is there a way to see what the person who ssh into my account is doing? What commands he is running from my account?

Improve this question
2
  • What makes you suspect someone logged into your account? Entries in wtmp? Files left over? Are you sure it's not e.g. a cron job? Commented Oct 27, 2018 at 16:36
  • If you are authenticating over ssh with public keys, you might try configuring the public key to execute a new bash session with a key specific history file... need to enable PermitUserEnvironment in /etc/ssh/sshd_config on the server and put environment="HISTFILE=~/.hist2" before the public key in the ~/.ssh/authorized_keys on the server. Commented Oct 27, 2018 at 17:28

1 Answer 1

Reset to default
0

Is there a way to see what the person who ssh into my account is doing? What commands he is running from my account?

You can use sysdig to monitor the ssh session activity:

sudo sysdig -A -c echo_fds proc.name=sshd

The sysdig can write the event to a dump file e,g:

sudo sysdig -C 1 -w dump.scap

it can be reviewed and filtred to check the user activity:

sudo sysdig -r dump.scap0 -c spy_users

Sysdig Examples

Improve this answer

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.