If a user execute commands remotely over ssh :
[user@remote ~] $ ssh USERNAME@SERVER COMMANDS
How the SERVER
administrator can log those COMMANDS
executed in a "not a tty" session ?
Also when a user invokes a new shell(running /bin/bash from existing bash shell
), commands executed in this new shell are not listed in user's bash history; How to log those commands ?
Best Answer
Just install GNU Accounting (
acct
for Debian/Ubuntu orpsacct
for RedHat/CentOS) and use the commandlastcomm
to trace all the commands executed by all your users.