Enabling auditd for Remote SSH Command Tracking

This guide outlines how to install, configure, and verify auditd on Arch Linux to log every command executed over non-interactive and interactive SSH sessions.

Arch

---

1. Installation

$ sudo pacman -S --noconfirm audit
$ sudo systemctl enable --now auditd

Verify:

$ sudo systemctl status auditd

---

2. Configuration Rules

Create a dedicated audit rule file under /etc/audit/rules.d/ to record all execve system calls executed by non-system user accounts (auid >= 1000).

Create /etc/audit/rules.d/execve.rules:

$ sudo tee /etc/audit/rules.d/execve.rules > /dev/null << 'EOF'
# Delete all existing rules
-D

# Set buffer size
-b 8192

# Log command executions for human/login users (auid >= 1000)
-a always,exit -F arch=b64 -S execve -F auid>=1000 -k remote_commands
-a always,exit -F arch=b32 -S execve -F auid>=1000 -k remote_commands
EOF

---

3. Applying Rules

Merge and load rule definitions into the kernel using augenrules:

$ sudo augenrules --load

Verify active rules:

$ sudo auditctl -l

Expected output:

-a always,exit -F arch=b64 -S execve -F auid>=1000 -k remote_commands
-a always,exit -F arch=b32 -S execve -F auid>=1000 -k remote_commands

---

4. Kernel Audit Enforcement (Optional)

Ensure kernel-level auditing is enabled by default. If auditctl -s reports enabled 0, append audit=1 to your bootloader (GRUB / systemd-boot) kernel parameters.

Check current status:

$ sudo auditctl -s

---

5. Querying Command Logs

Inspect command executions recorded by auditd:

View formatted execution logs:

$ sudo ausearch -k remote_commands -i --format text

Search for commands executed by a specific user:

$ sudo ausearch -k remote_commands -ua luke -i

Stream real-time execution logs:

$ sudo tail -f /var/log/audit/audit.log | grep "type=EXECVE"

---

6. Log Rotation & Storage Management

Manage log storage limits and rotation behavior in /etc/audit/auditd.conf:

max_log_file = 50
max_log_file_action = ROTATE
num_logs = 10

Restart auditd after making configuration changes to auditd.conf:

$ sudo systemctl restart auditd

OpenBSD

Process Accounting & SSH Command Tracking on OpenBSD

OpenBSD does not use Linux auditd. Instead, it provides native kernel process accounting (acct) and syslog-based sshd / doas auditing.

---

1. Native Process Accounting (acct)

Process accounting logs every command executed by every process (and user) on the system to /var/account/acct.

Enable Process Accounting:

# Create accounting log file if it does not exist
doas touch /var/account/acct

# Enable and start accounting daemon via rcctl
doas rcctl enable accounting
doas rcctl start accounting

Query Executed Commands:

Use lastcomm to query command execution history:

# View all recently executed commands
lastcomm

# View commands executed by a specific user
lastcomm luke

# View commands matching a specific binary
lastcomm pfctl

---

2. Verbose SSH Command Payload Logging

To record non-interactive SSH connections and payload commands in /var/log/authlog:

1. Edit /etc/ssh/sshd_config:

LogLevel VERBOSE

2. Reload sshd:

doas rcctl reload sshd

3. Monitor authentication & command execution logs:

doas tail -f /var/log/authlog

---

3. doas Privilege Escalation Logs

OpenBSD logs all elevated command executions via doas to /var/log/authlog by default:

doas grep doas /var/log/authlog