Is there a way to log SSH sessions proxied through a machine (User-> SSH Proxy -> Server (with SSH)) without modifying the SSH daemon on the proxy? I need to log all the commands as well as responses exchanged between the User and the Server.

  • use tshark, install tshark on SSH Proxy and run this command: tshark -i eth0 -f "http" -w httpcapture.cap , it writes all the captured traffic to httpcapture.cap file which you can later easily analyse – Ali May 7 '15 at 14:52
  • Thanks for answering. I don't think that will work. Wireshark captures packet at the interface level (eth0) and encryption is done on application layer. The captured traffic will be encrypted. – BrunoMCBraga May 7 '15 at 15:57
  • 1
    If the machine is for you, so you have the ssh encryption key, and can decrypt it, I think. – Ali May 7 '15 at 16:04
  • Can you also elaborate what you mean by "modifying the SSH Daemon on the proxy"? Are you referring to editing the source code or making configuration changes? – amccormack May 7 '15 at 17:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.