How to enable SSH session recording in CentOS 8 ?

CentOS 8 has been released and it includes some really amazing features. One feature that many security admins will greatly appreciate is session recording. With this feature, CentOS will record any/all SSH sessions, which includes all of the user activity that occurs during the session. Once recorded, videos of these sessions can be played back by any admin with a Cockpit login.

What you'll need

To make this work, you'll need the following:

• A running instance of CentOS 8
• A running instance of Cockpit 
• A user with sudo privileges

How to install necessary packages

Before that first session can be recorded, there are a few packages that must be installed. Open a terminal window and issue the following commands:

sudo systemctl enable --now cockpit.socket"

sudo dnf install tlog
sudo dnf install sssd
sudo dnf install cockpit-session-recording
sudo dnf install systemd-journal-remote

Then setup a very basic SSSD configuration to manage local RHEL users.

To do this, I created an /etc/sssd/sssd.conf file with this basic example configuration:
[domain/local]
id_provider = files

[sssd]
domains = local
services = nss, pam, ssh, sudo

I then set the sssd.conf file permissions, and restart sssd:
chmod 600 /etc/sssd/sssd.conf
systemctl restart sssd

The next step is to open a web browser and to browse to the cockpit web interface, which is available on port 9090.  I used firefox, and browsed to https://<IP-Address>:9090, where <IP-Address> is the IP address of the RHEL 8 server.  



Login to cockpit either as the root user, or you can login with another user with sudo privileges, and check the box on the login screen to "Reuse my password for privileged tasks".  

Once logged in, click on the "Session Recording" link on the left hand menu, then click the configuration gear button in the upper right corner.  






From here, several options can be configured such as a warning message to display to users to let them know their session is being recorded.   I’ll stick to the defaults, and scroll down to the SSSD Configuration section. From here, I’ll set the "Scope" to "All", and click the Save button.  This will configure session recording for all SSSD users.




Testing Out Session Recording

At this point, we have a basic session recording configuration setup, and we will confirm that it’s working. I’ll login to the server over SSH:







Notice the warning message that this session is being recorded (this message is configurable).  

Next, I’ll go ahead and run several commands which will be recorded, then exit out of the SSH session.  

Back from the web console interface, if I go back to the "Session Recording" menu option, I can see the sessions that have been recorded, including: the user name, the start and end times, and the duration of the recording:







I’ll click on the this line, which will take me to the session recording player screen, where I can click the play button and watch what happened during the session. I can also change the playback speed to speed up or slow down the playback.  In my recorded session, I had run the top command:






Accessing Recordings from the Command Line

It is also possible to access the recordings from the command line rather than the Cockpit web based interface.   By default, the session recordings are stored in journalctl.

The first step to playing back a session from the command line is to find the recording ID, by running a command such as journalctl -o verbose | grep \"rec\".

Once the recording ID has been determined, the session can be played back with the tlog-play -r journal -M TLOG_REC= command, where recording_ID is the recording ID found with the previous journalctl command.

As an example, see the screenshot of session playback: