Skip to main content

SSH Command Tracking Guide

Part 1: Arch Linux

Arch Linux uses the Linux Audit Framework (auditd) to capture system calls (execve) triggered by human login sessions (auid >= 1000).

1. Installation

$ sudo pacman -S --noconfirm audit
$ sudo systemctl enable --now auditd

2. Configuration Rules

Create /etc/audit/rules.d/execve.rules:

$ sudo tee /etc/audit/rules.d/execve.rules > /dev/null << 'EOF'
# Delete pre-existing rules
-D

# Buffer size
-b 8192

# Log all command executions for human/login users (auid >= 1000)
-a always,exit -F arch=b64 -S execve -F auid>=1000 -k remote_commands
-a always,exit -F arch=b32 -S execve -F auid>=1000 -k remote_commands
EOF

Load rules into the kernel:

$ sudo augenrules --load
$ sudo auditctl -e 1

Verify active rules:

$ sudo auditctl -l

3. Querying Command Logs

Inspect commands recorded by auditd:

# Query recorded execution logs for remote_commands
$ sudo ausearch -k remote_commands -i

# Stream raw audit events in real time
$ sudo tail -f /var/log/audit/audit.log | grep "type=EXECVE"

OpenBSD

OpenBSD uses native kernel process accounting (acct) to log process executions, combined with sshd verbose logging and doas syslog auditing.

1. Kernel Process Accounting (acct)

Process accounting logs every binary execution on the system to /var/account/acct.

Enable Accounting:

# Create log file
$ doas touch /var/account/acct

# Enable accounting at boot
$ echo "accounting=YES" | doas tee -a /etc/rc.conf.local

# Start accounting daemon immediately
$ doas /usr/sbin/accton /var/account/acct

Query Execution History:

Use lastcomm to query executed commands:

# View all recent executions
$ lastcomm

# View executions by user 'luke'
$ lastcomm luke

# View executions of specific binary
$ lastcomm pfctl

2. SSH Verbose Payload Logging

To log non-interactive SSH connections and payload commands to /var/log/authlog:

  1. Edit /etc/ssh/sshd_config: 
    LogLevel VERBOSE
  2. Reload sshd: 
    $ doas rcctl reload sshd
  3. Monitor logs: 
    $ doas tail -f /var/log/authlog

3. Privilege Escalation Logs (doas)

OpenBSD automatically logs all elevated doas commands to /var/log/authlog:

$ doas grep doas /var/log/authlog