4

I want to solve following problem. Please share your ideas or directly product name that capable to solve this.

Our system administrators need to connect customer's servers but I don't want to share SSH, VPN etc information with sys admins. Also I need to see log of commands that executed by sys admins.

to make the long story short, our system admin connect to the "box", then admin will be able to access customer servers. I deploy access credentials to the box, thus I don't need to share this sensitive info with system admin. One more thing, I want to see which commands executed by system admin for customer servers.

My plan is like following;

  1. We have one linux machine. I will deploy customer credentials on it.
  2. System admins will be able to connect this linux machine via VNC.
  3. Then admin can connect customer with one click.
  4. Record whole VNC session.

Thank you

Mehmet Ince
  • 258
  • 1
  • 9
  • Are you looking after something like this: https://www.youtube.com/watch?v=CITq80gf6Hk It's not exactly how you describe it, but similar. – sir_k Dec 12 '14 at 16:56
  • Do you need a secure system (even if they try hard, sys admin cannot access sensitive credentials) of just a secure looking system (they have no need to know that sensitive info, and it is obfuscated from them, but they could possibly find it with some work)? – Serge Ballesta Nov 29 '16 at 09:41

1 Answers1

0

1) What would be the purpose of deploying customer credentials? Is there any mechanism to reduce this portion. E.g., using ssh keys where client could revoke the key afterwards. If so, you've alleviated this issue.

2) VNC connection from your staff, is this local, remote. Have you created appropriate rules to enable trusted sources to connect while dropping others?

3) when you state "connect to customers with one click" I am under the impression you could create one independent program without having to use a central machine. You could write a simple shell script to record locally (on your colleagues' machines) and have it emailed to you.

4) vnc2flv

From the "just woke up" category using vnc2flv

# Example script maybe /usr/bin/watchdog.sh
# can be entered in user’s .bashrc or .bash_profile or other

self=`whoami`
dir=/tmp/`mktemp -d /tmp/recordingXXXXX`
file=`$self`-XXXXX

printf “Recording session for $self on `date`” > $dir/README 
recordwin.sh -all /tmp/$file

As simple as you can get.

  • 1) get ID of the user
  • 2) make a temporary directory
  • 3) specify a temporary file
  • 4) enter that information into a "README" file in temp directory
  • 5) Begin recording

There are plenty of mechanisms to do this, that is a generic baseline. You could have parameters set for your colleagues the moment they log in, and when they exit (e.g. before closing session, using ssh keys, have their recordings placed in a tar and scp'd over, along with an email sent to you stating they've exited and recording is complete.)

munkeyoto
  • 8,702
  • 17
  • 31