any way to track commands of a user logged in through ssh 2300

Unruh

dafyddj... ..What aboutvar-log-auth.log ? .. yes it will show me who logged in from where but still it will not tell me what commands the user ran.....

Joe Beanfish....

accton seems somewhat interesting..I will read it and get back..sorry Ima bit slow, so it may take a bit of time...

Jeremiah DeWitt Weiner..... Your suggestion also seems interesting..Ill read the documentation and get back...

Unruh....

The history command gives me all the command executed by a user over a period of time...but it does not specify whether the user of a particular command had logged in through ssh or was a local user...For eg...a.b.c.d logged in as root and exexuted sertain commands, his commands would be recorded in the same ~.-bashhistory file as any other user logged in as root..

..So how do you know he did that? sshd can sometimes die on its own... while searching through the history output, the command #service sshd stop was clearly mentioned...and the new sysadmin had mentioned that the previous command had been executed by him for sure..Although Im not accusing him with 100% surity but evidence points in his direction...

..No, but root's history should contain the commands... I have mentioned above that the history command does not give me the IP..

...Have you thought that maybe the system was rooted and someone was just replacing sshd with an altered version to allow them to log on anytime? ... Your suggestion has given some food for thought..I will look over..Have you heard of any such version....

Thanks Danish