Recording sessions

Procedure

1. Install cockpit-session-recording.

   # yum install cockpit-session-recording

2. Start or enable the web console on your system:

   # systemctl start cockpit.socket
   # systemctl enable cockpit.socket

   or

   # systemctl enable cockpit.socket --now

Procedure

1. Open the sssd-session-recording.conf configuration file:

   # vi /etc/sssd/conf.d/sssd-session-recording.conf

   Note

   The sssd-session-recording.conf file is created automatically once you have opened the configuration page in the web console interface.

2. To specify the scope of session recording, enter one of the following values for the scope option:

   • none to record no sessions.
   • some to record only specified sessions.
   • all to record all sessions.
3. Optional: If you set the scope as some add the names of users and groups in comma-separated lists.

4. To enable the SSSD profile, run the following command:

   # authselect select sssd with-files-domain

Procedure

1. Connect to the RHEL 8 web console locally by entering localhost:9090 or by entering your IP address <IP_ADDRESS>:9090 into your browser.

2. Log in to the RHEL 8 web console.

   Important

   Your user has to have administrator privileges to be able to view recorded sessions.

3. Go to the Session Recording page in the menu on the left.

4. Click on the gear button in the right top corner.

   

5. Set your parameters in the SSSD Configuration table. Separate the lists of users and groups with commas.

   Example 2.2. Configuration of recorded users with SSSD

   

Procedure

1. Create a directory to store exported recording sessions, such as `/tmp/dir:

   # mkdir /tmp/dir

2. Run the journalctl -o export command to export system journal entries related to tlog recordings:

   # journalctl _COMM=tlog-rec _COMM=tlog-rec-sessio -o export | /usr/lib/systemd/systemd-journal-remote -o /tmp/dir/example.journal -

   Note

   The COMM=tlog-rec-sessio COMM name is shortened due to a 15 character limit.

Procedure

1. You can play back the whole recording as follows:

Procedure

1. Create a playbook file, for example ~/playbook.yml, with the following content:

   ---
   - name: Deploy session recording
     hosts: managed-node-01.example.com
     tasks:
       - name: Enable session recording for specific users
         ansible.builtin.include_role:
           name: rhel-system-roles.tlog
     vars:
       tlog_scope_sssd: some
       tlog_users_sssd:
         - <recorded_user>

   tlog_scope_sssd: <value>

   The some value specifies you want to record only certain users and groups, not all or none.

   tlog_users_sssd:: <list_of_users>

   A YAML list of users you want to record a session from. Note that the role does not add users if they do not exist.

2. Validate the playbook syntax:

   $ ansible-playbook --syntax-check ~/playbook.yml

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   $ ansible-playbook ~/playbook.yml

Verification

1. Check the SSSD drop-in file’s content:

   # cd /etc/sssd/conf.d/sssd-session-recording.conf

   You can see that the file contains the parameters you set in the playbook.

2. Log in as a user whose session will be recorded, perform some actions, and log out.

3. As the root user:

   1. Display the list of recorded sessions:

      # journalctl _COMM=tlog-rec-sessio
      Nov 12 09:17:30 managed-node-01.example.com -tlog-rec-session[1546]: {"ver":"2.3","host":"managed-node-01.example.com","rec":"07418f2b0f334c1696c10cbe6f6f31a6-60a-e4a2","user":"demo-user",...
      ...

      You require the value of the rec (recording ID) field in the next step.

      Note that the value of the _COMM field is shortened due to a 15 character limit.

   2. Play back a session:

      # tlog-play -r journal -M TLOG_REC=<recording_id>

Procedure

1. Create a playbook file, for example ~/playbook.yml, with the following content:

   ---
   - name: Deploy session recording excluding users and groups
     hosts: managed-node-01.example.com
     tasks:
       - name: Exclude users and groups
         ansible.builtin.include_role:
           name: rhel-system-roles.tlog
         vars:
           tlog_scope_sssd: all
           tlog_exclude_users_sssd:
             - jeff
             - james
           tlog_exclude_groups_sssd:
             - admins

   tlog_scope_sssd: <value>

   The value all specifies that you want to record all users and groups.

   tlog_exclude_users_sssd: <user_list>

   A YAML list of users user names you want to exclude from the session recording.

   tlog_exclude_groups_sssd: <group_list>

   A YAML list of groups you want to exclude from the session recording.

2. Validate the playbook syntax:

   $ ansible-playbook --syntax-check ~/playbook.yml

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   $ ansible-playbook ~/playbook.yml

Verification

1. Check the SSSD drop-in file’s content:

   # cat /etc/sssd/conf.d/sssd-session-recording.conf

   You can see that the file contains the parameters you set in the playbook.

2. Log in as a user whose session will be recorded, perform some actions, and log out.

3. As the root user:

   1. Display the list of recorded sessions:

      # journalctl _COMM=tlog-rec-sessio
      Nov 12 09:17:30 managed-node-01.example.com -tlog-rec-session[1546]: {"ver":"2.3","host":"managed-node-01.example.com","rec":"07418f2b0f334c1696c10cbe6f6f31a6-60a-e4a2","user":"demo-user",...
      ...

      You require the value of the rec (recording ID) field in the next step.

      Note that the value of the _COMM field is shortened due to a 15 character limit.

   2. Play back a session:

      # tlog-play -r journal -M TLOG_REC=<recording_id>