As far as I know, when I SSH to a box, it will add my command history to something like .bash_history. But when I execute a command like rsync and it executes a remote SSH connection,
rsync -avz -e 'ssh -p1234' "/example/" mylogin@17.19.20.99:"/example/"
where is that logged?
Another example might be using a SFTP client that uses SSH to connect (like expanDrive) – where are those connections logged?
Clarification: I am referring to logging on the remote machine. So, if a hacker ssh`ed to a box and didn't delete out the .bash_history, you could see what s/he did. But if a hacker used the rsync command instead, does that mean there would be no record of it on the remote machine? fyi – I'm trying to investigate some weird activity on my server, and checking the logs isn't turning anything up.
Thanks!
Best Answer
if the specific process that called those commands doesn't log them, nobody will.
AFAIK, neither rsync nor expanDrive have such logs.