4 ms·
Pardon my 51yo brain, but I seem to remember that every ssh login is logged? Yes, auth.log if my memory serves.
by scarygliders 6y ago
Pardon my 51yo brain, but I seem to remember that every ssh login is logged?
Yes, auth.log if my memory serves.
- mcpherrinm 6y agoauth.log is way primitive compared to what teleport has. It logs the actual session data, and if "enhanced" recording is enabled, it uses BPF tracing to record all processes executions and files that were opened. fwiw, the web ui is optional. Nobody's taking away your ssh client.
- kohtatsu 6y agohttps://gravitational.com/teleport/how-it-works/audit-logging-for-ssh-and-kubernetes/ https://gravitational.com/teleport/how-it-works/audit-loggin... Their audit log can include a lot more in a more structured format, including wire activity and even std{in,out,err}.
- benarent 6y agoThis can only get you so far. We invested a lot time into getting more from system access event using eBPF to take n unstructured SSH session and outputs a stream of structured events. https://gravitational.com/blog/enhanced-session-recording/ https://gravitational.com/blog/enhanced-session-recording/
- kohtatsu 6y agoI was (naturally) skeptical at first as well, but this looks great. I saw on another page that audit logs are sent off server, presumably append-only, but can Teleport pause execution until after log replication is verified? For plain logs this would be straightforward, but for enhanced logging I suppose it'd be a matter of deciding when to pause execution, e.g. after downloading a file.