Sometimes we have contract developers that need to do work on the server (via ssh
or sftp
) and I've been looking for ways to monitor what they do on our Debian based server. We have ways of limiting access (restricting access by IP) so they only have access when we have them working on something but we would like to be able to monitor sessions in a way that we can see what they did (possible on desktop but I'm not sure if this is possible on a Linux server).
Sometimes contractors need privileged access to troubleshoot problems which may mean they can change nginx
configs or modify databases. Privileged access also gives them the ability to add malicious code (logic bombs, etc) or break stuff by accident without knowing what they did to break it.
LXD isn't a good enough option because it doesn't monitor key entries and the resources contractors need access to (entire php web application stack) is the asset. So if they break it, we have to switch to a backup web server anyway. While chroot
can be used to limit what the user can do, it's not a monitoring tool.
The history
file in Linux can be modified by the user and even if it couldn't be modified, it doesn't show commands run after entering a prompt (like after entering mysql
or opening a file). Adding git
to the root of the system has the same limitations.
We have a server that has the production database and native scripts for the website that we can quickly switch to in an emergency. But without a way to inventory who's had access AND exactly what they have done, tracing blame or even defining what was done is a nightmare.
Options I've Looked at:
- This option acts as an authorized MIM and records
ssh
session info on a proxy server. This is very similar to what I was saying would be ideal in my comments. I haven't tested this yet. - Similar option by ezeelogin but like the above option, i don't see a way to manage file changes over
sftp
so i'll have to test to find out if this is supported.
What solutions are available for this?
Are there any reliable key-loggers that can be used for this?
Are there any enterprise solutions for this?
sftp
it would simultaneously write the files sent to the intended destination as well as to a files log directory on the proxy server. I feel like this has to be possible.