Enterprise Cloud Security and Governance

Log all user commands

It is necessary to see what exactly users are doing once they have logged in to the system. Since SSH is a PAM-aware application, we can use PAM's session interface to store the session-related activity that will tell us about the commands that the users are typing.

Add these lines to both /etc/pam.d/system-auth and /etc/pam.d/password-auth:

session    required     pam_tty_audit.so enable=kplabs

Once done, log in to the kplabs.in user and type a few commands:

ping -c1 kplabs.incat /etc/passwd

Now, log out of that user with CTRL + D. This is important so that the data gets flushed to the logs immediately.

To find out what was done by the users, use the aureport option with the root user:

aureport --tty

You will find something ...