4

In a Linux terminal, I made a ssh connection from A to B and I used commands to read some files stored in B. Then I disconnected and I closed the terminal.

Is it possible to find on A, informations about which commands were used on B through the ssh connection.

Sorry for the noob questions, but thanks for any help!

  • On a typical system, all your commands are written to a file ~/.bash_history. – ott-- Feb 25 '15 at 2:11
  • 1
    @ott--, if you're SSHing to another system, it's the ~/.bash_history on that system that gets modified (and only if you're using bash). – Mark Feb 25 '15 at 3:10
  • 1
    @mark That's why I wrote "typical". All systems I worked with in the last 10 year have bash as default shell for users, and all have history enabled. – ott-- Feb 25 '15 at 3:24
  • @ott And none of them will record the history of what you did on another computer entirely. At most, .bash_history on A will have recorded that you started an SSH session to computer B. The shell can't look into the memory of a program it launches. – Shadur Mar 6 '15 at 9:25
  • @Shadur Somehow I've missed about what is logged on computer A only. – ott-- Mar 6 '15 at 13:14
1

It depends... you can set things up so the commands are recorded on the client side. By default the sent commands are not logged by the client though, if that is your question. A much more common configuration (security-wise), if audit logging (via pam or some such method beyond just simple ~/.bash_history) was enabled they would see that ssh was run and then could review logging on "B" and find what was run on the "target". This is all "if" things are configured for this, it may be possible to track down the info.

  • I come back to this topic. It is possible that some temporary files containing the history of the display of the terminal are stored on the hard disk of computer A? Then it is possible to retrieve these informations using a software like PhotoRecovery or Foremost? For instance, to recover a file containing: "$ ssh X@Y.Y.Y.Y X@Y.Y.Y.Y passwd: The authenticity of host '[Y.Y.Y.Y]:22' can't be established. RSA key fingerprint is ZZZZZZZ. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added '[Y.Y.Y.Y]:22' (RSA) to the list of known hosts. [...]" Thank you – tibo Jun 8 '15 at 22:52
  • Sorry, Y.Y.Y.Y is B. – tibo Jun 8 '15 at 23:00
  • 1
    By default, you would normally see only the command executed in the shell. This being the ~/.bash_history file. You don't see everything that occurs on the CLI... only the commands you execute. In the case stated above, you would likely see "ssh X@Y.Y.Y.Y X@Y.Y.Y.Y" until the history has been removed or expired (based on configurations). As far as recovery of that text file, yes it might be possible to recover it depending on how much has been written to disk after removing the history file. – Goblinlord Jun 9 '15 at 0:20
  • I am agree for the ~/.bash_history. But I want to know if there is some temporary files of the display history of the terminal. Not only the command used but all the output (like the informations which are recorded using the "script" command). – tibo Jun 10 '15 at 0:12
  • 1
    No it is in memory (RAM) only by default. This is not to say it can't be, it is just not something setup by default typically. – Goblinlord Jun 10 '15 at 0:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.