Chapter 24. Configuring a system for session recording using the tlog RHEL System Role

Procedure

1. Create a new playbook.yml file with the following content:

   ---
   - name: Deploy session recording
     hosts: all
     vars:
       tlog_scope_sssd: some
       tlog_users_sssd:
         - recorded-user
   
     roles:
       - rhel-system-roles.tlog

   Where,

   • tlog_scope_sssd:

     • some specifies you want to record only certain users and groups, not all or none.

   • tlog_users_sssd:

     • recorded-user specifies the user you want to record a session from. Note that this does not add the user for you. You must set the user by yourself.

2. Optionally, verify the playbook syntax.

   # ansible-playbook --syntax-check playbook.yml

3. Run the playbook on your inventory file:

   # ansible-playbook -i IP_Address /path/to/file/playbook.yml -v

1. Navigate to the folder where the SSSD configuration drop file is created:

   # cd /etc/sssd/conf.d

2. Check the file content:

   # cat /etc/sssd/conf.d/sssd-session-recording.conf

Procedure

1. Create a new playbook.yml file with the following content:

   ---
   - name: Deploy session recording excluding users and groups
     hosts: all
     vars:
       tlog_scope_sssd: all
       tlog_exclude_users_sssd:
         - jeff
         - james
       tlog_exclude_groups_sssd:
         - admins
   
     roles:
       - rhel-system-roles.tlog

   Where,

   • tlog_scope_sssd:

     • all: specifies that you want to record all users and groups.

   • tlog_exclude_users_sssd:

     • user names: specifies the user names of the users you want to exclude from the session recording.

   • tlog_exclude_groups_sssd:

     • admins specifies the group you want to exclude from the session recording.

2. Optionally, verify the playbook syntax;

   # ansible-playbook --syntax-check playbook.yml

3. Run the playbook on your inventory file:

   # ansible-playbook -i IP_Address /path/to/file/playbook.yml -v

1. Navigate to the folder where the SSSD configuration drop file is created:

   # cd /etc/sssd/conf.d

2. Check the file content:

   # cat sssd-session-recording.conf

Procedure

1. Create a user and assign a password for this user:

   # useradd recorded-user
   # passwd recorded-user

2. Log in to the system as the user you just created:

   # ssh recorded-user@localhost

3. Type "yes" when the system prompts you to type yes or no to authenticate.

4. Insert the recorded-user’s password.

   The system displays a message about your session being recorded.

   ATTENTION! Your session is being recorded!

5. After you have finished recording the session, type:

   # exit

   The system logs out from the user and closes the connection with the localhost.

1. Run the command below:

   # journalctl -o verbose -r

2. Search for the MESSAGE field of the tlog-rec recorded journal entry.

   # journalctl -xel _EXE=/usr/bin/tlog-rec-session

Procedure

1. On the CLI terminal, play the user session recording:

   # journalctl -o verbose -r

2. Search for the tlog recording:

   $ /tlog-rec

   You can see details such as:

   • The username for the user session recording
   • The out_txt field, a raw output encode of the recorded session
   • The identifier number TLOG_REC=ID_number
3. Copy the identifier number TLOG_REC=ID_number.

4. Playback the recording using the identifier number TLOG_REC=ID_number.

   # tlog-play -r journal -M TLOG_REC=ID_number