Hi. On Wed, Dec 14, 2016 at 08:53:11AM -0300, info info wrote: > Hi, setting > > session required pam_tty_audit.so enable=* > > in /etc/pam.d/sshd (or common-session) > > doesn't work due to bug #778664 [1]. How do you do that in Debian? > Workarounds? Alternatives?
It does not allow tty snooping per se, but it logs all executed commands by anyone (use '-F euid' to narrow the scope): auditctl -a exit,always -F arch=b64 -S execve auditctl -a exit,always -F arch=b32 -S execve Reco