Skip to main content

Enabling auditd for Remote SSH Command Tracking

This guide outlines how to install, configure, and verify auditd on Arch Linux to log every command executed over non-interactive and interactive SSH sessions.

Arch

1. Installation

$ sudo pacman -S --noconfirm audit
$ sudo systemctl enable --now auditd

Verify:

$ sudo systemctl status auditd

2. Configuration Rules

Create a dedicated audit rule file under /etc/audit/rules.d/ to record all execve system calls executed by non-system user accounts (auid >= 1000).

Create /etc/audit/rules.d/execve.rules:

$ sudo tee /etc/audit/rules.d/execve.rules > /dev/null << 'EOF'
# Delete all existing rules
-D

# Set buffer size
-b 8192

# Log command executions for human/login users (auid >= 1000)
-a always,exit -F arch=b64 -S execve -F auid>=1000 -k remote_commands
-a always,exit -F arch=b32 -S execve -F auid>=1000 -k remote_commands
EOF

3. Applying Rules

Merge and load rule definitions into the kernel using augenrules:

$ sudo augenrules --load

Verify active rules:

$ sudo auditctl -l

Expected output:

-a always,exit -F arch=b64 -S execve -F auid>=1000 -k remote_commands
-a always,exit -F arch=b32 -S execve -F auid>=1000 -k remote_commands

4. Kernel Audit Enforcement (Optional)

Ensure kernel-level auditing is enabled by default. If auditctl -s reports enabled 0, append audit=1 to your bootloader (GRUB / systemd-boot) kernel parameters.

Check current status:

$ sudo auditctl -s

5. Querying Command Logs

Inspect command executions recorded by auditd:

View formatted execution logs:

$ sudo ausearch -k remote_commands -i --format text

Search for commands executed by a specific user:

$ sudo ausearch -k remote_commands -ua luke -i

Stream real-time execution logs:

$ sudo tail -f /var/log/audit/audit.log | grep "type=EXECVE"

6. Log Rotation & Storage Management

Manage log storage limits and rotation behavior in /etc/audit/auditd.conf:

max_log_file = 50
max_log_file_action = ROTATE
num_logs = 10

Restart auditd after making configuration changes to auditd.conf:

$ sudo systemctl restart auditd

OpenBSD

Process Accounting & SSH Command Tracking on OpenBSD

OpenBSD does not use Linux auditd. Instead, it provides native kernel process accounting (acct) and syslog-based sshd / doas auditing.

1. Native Process Accounting (acct)

Process accounting logs every command executed by every process (and user) on the system to /var/account/acct.

Enable Process Accounting:

# Create accounting log file if it does not exist
doas touch /var/account/acct

# Enable and start accounting daemon via rcctl
doas rcctl enable accounting
doas rcctl start accounting

Query Executed Commands:

Use lastcomm to query command execution history:

# View all recently executed commands
lastcomm

# View commands executed by a specific user
lastcomm luke

# View commands matching a specific binary
lastcomm pfctl

2. Verbose SSH Command Payload Logging

To record non-interactive SSH connections and payload commands in /var/log/authlog:

    Edit /etc/ssh/sshd_config: 
    LogLevel VERBOSE
      Reload sshd: 
      doas rcctl reload sshd
        Monitor authentication & command execution logs: 
        doas tail -f /var/log/authlog

        3. doas Privilege Escalation Logs

        OpenBSD logs all elevated command executions via doas to /var/log/authlog by default:

        doas grep doas /var/log/authlog