i'd like to use logkeys to log keystrokes on an SSH'able Linux box. Logkeys intercepts a Device, can this be used for SSH access? Does an SSH session use a Device? or does SSH bypass this level of input?
21 Answer
logkeys will log only keystrokes of keyboard(s) (USB or serial) connected to the machine logkeys is running on.
SSH daemon receives the input over a TCP connection not from a keyboard-like device. The devices sshd uses are pseudo terminals. They work on a different level than a keyboard device and they are between sshd and the programs being run (not between sshd and the user).
logkeys does not work with terminal so you have to use a different solution. It would be rather a "session logger/recorder" as it does not log keystrokes directly from keyboard.
Run a wrapper from authorized_keys
You can run a session recording wrapper instead of directly running a shell or a command. It could be specified in the file ~/.ssh/authorized_keys by using the commnad directive. The users must use the key authentication for this to work. It will not work with password authentication. A prepared script is available for example here: Recording SSH sessions
Run a wrapper instead of a user's shell
Instead of a user's shell you can run a session recording wrapper. There is one: rootsh (basic functionality similar to the wrapper above). You can for example replace user's login shell.
3
