4 ms·
We don't have detailed docs on our audit logs yet. Here's short description: Teleport's SSH servers capture PTY output and send logs to the audit server along
by alexk 10y ago
We don't have detailed docs on our audit logs yet.
Here's short description:
Teleport's SSH servers capture PTY output and send logs to the audit server alongside with session metadata.
Every SSH session has a unique identifier, teleport users participated in this session and captured activity.
Sessions (structured events) and audit logs can be stored in various sources, for example recently we've implemented SumoLogic for audit events and S3 for session recordings for some of our customers to upload and store this information.
Obviously, you could do various things (especially if you are root) to tamper with this system. For these use cases I would use something like https://github.com/draios/falco https://github.com/draios/falco to capture all application-level activity.
- sandGorgon 10y agoThis is awesome ! Would love to see a doc for detailed audit logging when you have one up. This in itself is a killer app ! EDIT: one more request, please make you docs/makefile a little more beginner friendly. For example, your get-started page (or your makefile target) does not have systemd targets in place. I think you guys take care of necessary selinux permissions inside code.. but not sure if it does so for /var/lib/teleport. it might be useful to consider using ansible (which will make this very practical for devops)
- alexk 10y agoThanks for your feedback, I've created an issue to track: https://github.com/gravitational/teleport/issues/677 https://github.com/gravitational/teleport/issues/677 Docs will be out with 1.5 release