Skip to main content

SSH Command Tracking Guide

Part 1: Arch Linux

The Linux Audit Framework (auditd) captures execve system calls triggered by user sessions (auid >= 1000).

1. Installation & Service Setup

Install the audit package and enable the auditd daemon:

$ sudo pacman -S --noconfirm audit
$ sudo systemctl enable --now auditd

2. Configuration Rules

Create /etc/audit/rules.d/execve.rules:

$ sudo tee /etc/audit/rules.d/execve.rules > /dev/null << EOF
# Delete pre-existing rules
-D

# Set kernel buffer size
-b 8192

# Log all command executions for human/login users (auid >= 1000)
-a always,exit -F arch=b64 -S execve -F auid>=1000 -k remote_commands
-a always,exit -F arch=b32 -S execve -F auid>=1000 -k remote_commands
EOF

Load rules into the active kernel:

$ sudo augenrules --load
$ sudo auditctl -e 1

Verify active rules:

$ sudo auditctl -l

3. Real-Time Command Inspection (audit-log)

Query command executions using the high-speed audit-log helper script:

# View the last 20 executed commands (Default)
$ sudo audit-log

# View a specific number of recent commands (e.g. 50 entries)
$ sudo audit-log 50

# View ALL recorded command history
$ sudo audit-log all

# Count total logged command executions
$ sudo audit-log all | wc -l

Sample Output:

2026-08-09 13:06:51 | sudo audit-log 20
2026-08-09 13:06:51 | tail -n 20
2026-08-09 13:06:51 | /usr/bin/unix_chkpwd root chkexpiry

Part 2: OpenBSD (Router danknasty)

OpenBSD uses native kernel process accounting (acct) to track binary executions, alongside syslog-based sshd verbose logging and doas auditing.

1. Kernel Process Accounting (acct)

Enable Accounting:

# Create log file
$ doas touch /var/account/acct

# Enable accounting at boot
$ echo "accounting=YES" | doas tee -a /etc/rc.conf.local

# Start accounting daemon immediately
$ doas /usr/sbin/accton /var/account/acct

2. Real-Time Command Inspection (audit-log)

Query process execution history using the matching audit-log helper script:

# View the last 20 executed commands (Default)
$ doas audit-log

# View a specific number of recent commands (e.g. 50 entries)
$ doas audit-log 50

# View ALL recorded command history
$ doas audit-log all

# Count total logged command executions
$ doas audit-log all | wc -l

Sample Output:

2026-08-09 13:06:00 | date
2026-08-09 13:06:00 | chmod
2026-08-09 13:06:00 | tee
2026-08-09 13:06:00 | lastcomm

3. SSH Verbose Payload & doas Logging

To log non-interactive SSH connections and payload commands to /var/log/authlog:

  1. Edit /etc/ssh/sshd_config: 
    LogLevel VERBOSE
  2. Reload sshd: 
    $ doas rcctl reload sshd
  3. Monitor logs: 
    $ doas tail -f /var/log/authlog