Add the following line to /etc/profile to setup full logging of all ssh sessions:
script -q /var/log/sessions/ssh-date +%d-%M-%Y-%Hh-%Mm-%Ss–whoami-$$.log && exit
Of course this is a security risk and violates user privacy.
SSH session logging
Have a project or a problem?
Talk with a senior engineer for practical recommendations—no obligation.
Leave a comment
Related Posts
Reliable Penguin provides managed web hosting, systems administration, website and server migrations, and expert consulting.
Recent Updates
March 5, 2026
February 25, 2026
February 25, 2026
2 Responses
script command will be visible with ps. This is not the way we want, because an attacker can easily find the log and just remove it right before leaving your place.
I’ ve found a little better solution but it still needs some work.
sites.google.com/site/wozoopalinux/home/security/log-ssh-session
I took a look at your approach .. seems valid but takes a good bit more work … guess it depends on how stealthy and long turn an implementation you’re looking for.