pam_tty_audit and auditd vs session recording

Say an alert fires because a database server is talking to an unknown address. auditd shows you that curl and tar ran, and which account started them, even if the user switched to root with su.

Then you check the keystroke log. It shows cat /etc/my, a tab, vi, the up arrow. You know which keys were pressed. You don't know what tab completion filled in, what cat printed, or what was saved in vi. On RHEL 8, a session that's still open may show nothing yet, because keystrokes are written at logout.

auditd told you the process, the account and the file. What was on the screen has to come from a session recording.

auditd collects security events from the kernel, whatever caused them: a cron job, a background service, or a script started by a compromised web server. It detects; it doesn't block anything. Red Hat ships a sample rule set for DISA STIG compliance, and you can lock the rules so they can't change until the next reboot.

Keystroke logging is off by default. You turn it on per user by adding pam_tty_audit to the login configuration (for SSH, /etc/pam.d/sshd), and read the results with aureport --tty. Know these limits before you rely on it:

• ›It records input only. Special keys show up as labels like <tab> and <up>, and nothing on screen is captured.
• ›It skips normal password prompts by default.
• ›It does log passwords typed into an onward SSH connection. If a user hops from this server to another, the second server's password lands in the log.
• ›Programs started from the session inherit keystroke logging, including services the user restarts. The man page recommends turning it off for most services first.

Keep forwarding audit events to your SIEM. shellz doesn't audit system calls or export to a SIEM, so it can't replace that trail.

shellz records SSH logins, one-off remote commands, SFTP, local and serial consoles, su -, desktop terminals, tmux and screen, and docker exec. Each session is encrypted before upload. If a login gets around the recorder, shellz ends it and alerts you. AI agents that log in are recorded like people. An agent running as a background service never logs in, so only auditd sees it.

In an incident, the audit event gives you the time, process and account. The recording shows the output and what was in the editor. If all your servers run RHEL, see the tlog comparison. If you're on Ubuntu and lost sudo session logs, see the sudo I/O logging options.

auditd and pam_tty_audit are free, ship with every major distribution, and feed your existing SIEM. Add replay only if someone will use it. The free shellz plan covers 10 active devices, enough for a production trial next to auditd (pricing).