Record SSH sessions on Linux server, Amazon EC2 instances for Security Compliance
It is mandatory to record ssh sessions to be PCI DSS Complaint when system administrator, system engineers or devops engineers login via ssh into your Linux machines or cloud instances, . It is also a must to maintain a log of all ssh activities on your Linux servers. This is tedious task for any Linux system administrator as deploying a improvised solution has often turned to be useless in the hour of need.
Why should Linux admins record ssh session of staff /employees on a ssh jump server ?
Imagine that you have 100 Linux servers and 100 staff having access to these remote linux server via SSH with some staff having privileged access or root access. If a user deletes a critical files or a database record which leads to a serious downtime and million of dollar lost in revenue, following are some of the questions that you would have to answer as the security officer of your Linux infrastructure.
- Which user did it ? How will you find out who is responsible when you have so many of your employees accessing your servers?
- How did it happen? When did it happen?
- What is the extent of damage?
- How will you prevent this in the future?
- Is it possible to track ssh server activities of employees?
- Is it possible to do a forensic investigation when somebody does something bad like opening a backdoor?
- How to monitor a staff in ssh in real time?
- Has any Linux server been breached?
- How to ensure that your employees password typed in on STDIN are not recorded as required by security compliances ?
Enabling the Record SSH Session feature in the Ezeelogin SSH jump server would help you achieve this very quickly and easily so you have a complete record of what was done on your server at any point of time by which jump server user. This is very useful for forensic SSH log audits or for maintaining an audit trail for pci compliance. Ezeelogin records every SSH activity. It includes the user input and the output with timestamps. There is provision to search through the recorded SSH logs as well.