See past commands issued

[LinuxLegends]

This is a hypothetical question

So let's say my friend promises I can trust him to SSH into my Debian-based Linux VPS hosted on a VPS provider

Is there a way to view every command he's entered in the logs without the possibility that he deleted malicious log entries?
Or some program that can monitor all commands entered?
Or can I set him up as a non-root sudo, then monitor all activity as root?

 

[f33dm3bits]

Are you wanting to give him an account with full sudo rights or just a regular account, if the latter it's not really needed since they can't break anything with a normal user account or access anything that would require root access. If you have doubts about if you can really trust this friend I wouldn't give him access to your vps, but if you still want to you can use audit rules.

Configure Linux system auditing with auditd

Sysadmins use audits to discover security violations and track security-relevant information on their systems. Based on preconfigured rules and propertie...

www.redhat.com

7.5. Defining Audit Rules | Red Hat Product Documentation

7.5. Defining Audit Rules | Red Hat Documentation

access.redhat.com

Chapter 14. Auditing the system Red Hat Enterprise Linux 8 | Red Hat Customer Portal

Access Red Hat’s knowledge, guidance, and support through your subscription.

access.redhat.com

 

[Dart]

If yo don't want to learn a bunch...

Up front, this may need a little massaging for your particular shell. I use ksh.

Set him up as regular user (why take the chance). If the person proves themselves trust worthy you can always open up the access.

In his .profile add the command set -o vi and whatever else you find necessary. With that, once you su to his account it's pretty easy to see what's been typed. To see past command tap the escape key, then tap the "k" key. Keep tapping to go back in the history.

Addendum,
If you do use the korn shell, if you're looking for a particular command that was typed, after hitting esc k, type / then type the name of the command you're looking for. If you want to exit the search, type dd