SSH Command Tracking Guide

This

Part guide outlines how to install, configure, and verify auditd on1: Arch Linux

Arch Linux uses the Linux Audit Framework (auditd) to logcapture everysystem commandcalls executed(execve) overtriggered non-interactiveby andhuman interactivelogin SSHsessions sessions.(auid >= 1000).

Arch

---

1. Installation

$ sudo pacman -S --noconfirm audit
$ sudo systemctl enable --now auditd

Verify:

$ sudo systemctl status auditd

---

2. Configuration Rules

Create a dedicated audit rule file under /etc/audit/rules.d/ to record all execve system calls executed by non-system user accounts (auid >= 1000).

Create /etc/audit/rules.d/execve.rules:

$ sudo tee /etc/audit/rules.d/execve.rules > /dev/null << 'EOF'
# Delete all pre-existing rules
-D

# Set bufferBuffer size
-b 8192

# Log all command executions for human/login users (auid >= 1000)
-a always,exit -F arch=b64 -S execve -F auid>=1000 -k remote_commands
-a always,exit -F arch=b32 -S execve -F auid>=1000 -k remote_commands
EOF

---

Load

3. Applying Rules

Merge and load rule definitionsrules into the kernel using augenrules:kernel:

$ sudo augenrules --load
$ sudo auditctl -e 1

Verify active rules:

$ sudo auditctl -l

Expected output:

-a always,exit -F arch=b64 -S execve -F auid>=1000 -k remote_commands
-a always,exit -F arch=b32 -S execve -F auid>=1000 -k remote_commands

---

4. Kernel Audit Enforcement (Optional)

Ensure kernel-level auditing is enabled by default. If auditctl -s reports enabled 0, append audit=1 to your bootloader (GRUB / systemd-boot) kernel parameters.

Check current status:

$ sudo auditctl -s

---

5.3. Querying Command Logs

Inspect command executionscommands recorded by auditd:

View

# formattedQuery recorded execution logs:

logs

for remote_commands
$ sudo ausearch -k remote_commands -i

--format# text

Search for commands executed by a specific user:

$ sudo ausearch -k remote_commands -ua luke -i

Stream real-raw audit events in real time execution logs:

$ sudo tail -f /var/log/audit/audit.log | grep "type=EXECVE"

---

6. Log Rotation & Storage Management

Manage log storage limits and rotation behavior in /etc/audit/auditd.conf:

max_log_file = 50
max_log_file_action = ROTATE
num_logs = 10

Restart auditd after making configuration changes to auditd.conf:

$ sudo systemctl restart auditd

OpenBSD

---

OpenBSD uses native kernel process accounting (acct) to log process executions, combined with sshd verbose logging and doas syslog auditing.

1. NativeKernel Process Accounting (acct)

Process accounting logs every commandbinary executed by every process (and user)execution on the system to /var/account/acct.

Enable Process Accounting:

# Create accounting log file
if it does not exist$ doas touch /var/account/acct

# Enable andaccounting startat boot
$ echo "accounting=YES" | doas tee -a /etc/rc.conf.local

# Start accounting daemon viaimmediately
rcctl$ doas rcctl/usr/sbin/accton enable accounting
doas rcctl start accounting/var/account/acct

Query ExecutedExecution Commands:History:

Use lastcomm to query commandexecuted execution history:commands:

# View all recentlyrecent executedexecutions
commands$ lastcomm

# View commands executedexecutions by auser specific'luke'
user$ lastcomm luke

# View commandsexecutions matching aof specific binary
$ lastcomm pfctl

---

2. Verbose SSH CommandVerbose Payload Logging

To recordlog non-interactive SSH connections and payload commands into /var/log/authlog:

1. Edit /etc/ssh/sshd_config:

LogLevel VERBOSE

2. Reload sshd:

sshd:

$ doas rcctl reload sshd

3. Monitor authentication & command execution logs:

$ doas tail -f /var/log/authlog

---

3. doas Privilege Escalation Logs (doas)

OpenBSD automatically logs all elevated command executions via doas commands to /var/log/authlog by default::

$ doas grep doas /var/log/authlog