How can I log user activity on SSH

Question

Possible Duplicate:
How do I log every command executed by a user?

How can I log SSH activity on 10.04 Ubuntu Server? This includes all commands he issued and output he got.

Answer 1

2 options I see for you:

1. Use rootsh. Rootsh is a wrapper for shells which logs all echoed keystrokes and terminal output to a file and/or to syslog. It's main purpose is the auditing of users who need a shell with root privileges. They start rootsh through the sudo mechanism. This wil not log everything, only what they perform in a root shell.

2. Use screen. You can force users in a screen-session when they log on to your server, you can then use screen to log everything they type.

But the bottom-line is, if you don't trust a user, don't allow them on your system. No system is bulletproof.

Answer 2

Possible screen as shell?

But its hard for be sure, that user cant hack that.

Answer 3

Add:

LogLevel Debug3

to /etc/ssh/sshd_config and restart.

Note: "Logging with a DEBUG level violates the privacy of users and is not recommended."