tlog and scp

[Krecmer, Frantisek]

Hello,

when I try to scp file to a server using account with enabled tlog-rec-session it fails
with message connection closed by remote host. It works fine when I change login shell to
bash instead of tlog-rec-session.
Question is: is this correct behavior? Is it bug or feature? ;) Is tlog not supporting scp
at the moment? Or do I have something bad in configuration?
I went through man, docs and internets but couldn’t find the answer, so I am trying
here.

verbose ssh log (IP changed to xxx.xxx.xxx.xxx):

debug1: Next authentication method: password
user(a)xxx.xxx.xxx.xxx's password:
debug1: Authentication succeeded (password).
Authenticated to xxx.xxx.xxx.xxx ([xxx.xxx.xxx.xxx]:22).
debug1: channel 0: new [client-session]
debug1: Requesting no-more-sessions(a)openssh.com
debug1: Entering interactive session.
debug1: pledge: network
debug1: Sending environment.
debug1: Sending env LANG = en_US.UTF-8
debug1: Sending command: scp -v -t /tmp
*** ATTENTION! Your session is being recorded per company policy! ***



[root@oci-lab ~]# debug1: channel 0: free: client-session, nchannels 1
debug1: fd 0 clearing O_NONBLOCK
debug1: fd 1 clearing O_NONBLOCK
Connection to xxx.xxx.xxx.xxx closed by remote host.
Transferred: sent 3616, received 3080 bytes, in 0.5 seconds
Bytes per second: sent 6802.0, received 5793.7
debug1: Exit status -1

Configuration file (/etc/tlog/tlog-rec-session.conf):
{
  "shell" : "/bin/bash",
  "notice" : " *** ATTENTION! Your session is being recorded per company
policy! ***\n\n",
  "log": {
      "input" : true,
      "output" : true,
      "window" : true
  },
  "limit": {
      "rate" : 16384,
      "burst" : 32768,
      "action" : "pass"
  },
  "syslog": {
      "facility" : "local4",
      "priority" : "info"
  },
  "writer" : "syslog"
}

OS is OL (based on RHEL6) 6.10 with kernel 4.1.12-124.25.1.el6uek.x86_64

Thank you for any info,

[Oracle NETSuite]
Frantisek Krecmer | SE/CE Senior Linux System Admin
[e-mail]<mailto:[e-mail]> | Cloud Systems Engineering
Dornych 510/38 | Brno, Czech republic 617 00

[Justin Stephenson]

Hello,

What version of tlog are you using? I tested tlog-6.1 version on Fedora and
RHEL6 and did not see any problems with scp behavior.

Your configuration looks okay as well, it should work I think.

-Justin

On Tue, Jan 21, 2020 at 8:32 AM Krecmer, Frantisek <fkrecmer(a)netsuite.com&gt;
wrote:

>  Hello,
>
>
>
>  when I try to scp file to a server using account with enabled
>  tlog-rec-session it fails with message connection closed by remote host. It
>  works fine when I change login shell to bash instead of tlog-rec-session.
>
>  Question is: is this correct behavior? Is it bug or feature? ;) Is tlog
>  not supporting scp at the moment? Or do I have something bad in
>  configuration?
>
>  I went through man, docs and internets but couldn’t find the answer, so I
>  am trying here.
>
>
>
>  verbose ssh log (IP changed to xxx.xxx.xxx.xxx):
>
>
>
>  debug1: Next authentication method: password
>
>  user(a)xxx.xxx.xxx.xxx&#39;s password:
>
>  debug1: Authentication succeeded (password).
>
>  Authenticated to xxx.xxx.xxx.xxx ([xxx.xxx.xxx.xxx]:22).
>
>  debug1: channel 0: new [client-session]
>
>  debug1: Requesting no-more-sessions(a)openssh.com
>
>  debug1: Entering interactive session.
>
>  debug1: pledge: network
>
>  debug1: Sending environment.
>
>  debug1: Sending env LANG = en_US.UTF-8
>
>  debug1: Sending command: scp -v -t /tmp
>
>  *** ATTENTION! Your session is being recorded per company policy! ***
>
>
>
>
>
>
>
>  [root@oci-lab ~]# debug1: channel 0: free: client-session, nchannels 1
>
>  debug1: fd 0 clearing O_NONBLOCK
>
>  debug1: fd 1 clearing O_NONBLOCK
>
>  Connection to xxx.xxx.xxx.xxx closed by remote host.
>
>  Transferred: sent 3616, received 3080 bytes, in 0.5 seconds
>
>  Bytes per second: sent 6802.0, received 5793.7
>
>  debug1: Exit status -1
>
>
>
>  Configuration file (/etc/tlog/tlog-rec-session.conf):
>
>  {
>
>    "shell" : "/bin/bash",
>
>    "notice" : " *** ATTENTION! Your session is being recorded per company
>  policy! ***\n\n",
>
>    "log": {
>
>        "input" : true,
>
>        "output" : true,
>
>        "window" : true
>
>    },
>
>    "limit": {
>
>        "rate" : 16384,
>
>        "burst" : 32768,
>
>        "action" : "pass"
>
>    },
>
>    "syslog": {
>
>        "facility" : "local4",
>
>        "priority" : "info"
>
>    },
>
>    "writer" : "syslog"
>
>  }
>
>
>
>  OS is OL (based on RHEL6) 6.10 with kernel 4.1.12-124.25.1.el6uek.x86_64
>
>
>
>  Thank you for any info,
>
>
>
>  [image: Oracle NETSuite]
>  Frantisek Krecmer | SE/CE Senior Linux System Admin
>
>  fkrecmer(a)netsuite.com | Cloud Systems Engineering
>
>  Dornych 510/38 | Brno, Czech republic 617 00
>  _______________________________________________
>  Scribery-devel mailing list -- scribery-devel(a)lists.fedoraproject.org
>  To unsubscribe send an email to
>  scribery-devel-leave(a)lists.fedoraproject.org
>  Fedora Code of Conduct:
>  https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
>  https://lists.fedoraproject.org/archives/list/[e-mail]...
>