[SOLVED] view what users are doing over SSH?

[lts]

Is there a linux tool to view what users are doing when users are using SSH? (i.e. what files are they accessing/download from the server? etc ...)

Thanks for the help

[Krendoshazin]

No I don't believe there is. The whole point of the connection being encrypted is so that nobody can see what you're doing, that includes anyone on the host system.

[bigtomrodney]

Something I came across this week:

If you have users connected over sftp/ssh for file transfers they don't show up as logged in and therefore won't show up when you run the who command. You can run

ps aux |grep sshd

and you'll see who's connected to your system. Not quite what you were looking for but thought I'd share

[lts]

Sorry for taking too long to response back, my HDs kept dying. It took a while for recovering, and restoring all the files.

Something I came across this week:

If you have users connected over sftp/ssh for file transfers they don't show up as logged in and therefore won't show up when you run the who command. You can run

ps aux |grep sshd

and you'll see who's connected to your system. Not quite what you were looking for but thought I'd share

Thanks for sharing bigtom, what I'm looking for probably an auditing tool. I did not have a chance to evaluate all the tools available yet.

Thanks everyone for replying to this thread. Consider this thread as SOLVED.