Chapter 1. Getting started with session recording on RHEL
1.1. Session recording in RHEL
This section introduces the session recording solution and its purpose.
The session recording solution is provided within Red Hat Enterprise Linux 8 and it is based on the tlog package. The
tlog package and its associated web console session player provide you with the ability to record and playback user terminal sessions. You can configure the recording to take place per user or user group via the SSSD service. All terminal input and output is captured and stored in a text-based format in the system journal.
Recording of the terminal input is turned off by default to not intercept raw passwords and other sensitive information.
The solution can be used for auditing user sessions on security-sensitive systems or, in the event of a security breach, reviewing recorded sessions as part of forensic analysis. System administrators are able to configure session recording locally on RHEL 8.0 systems. You can review the recorded sessions from the web console interface or in a terminal using the
1.2. Components of session recording
There are three main components key to the session recording solution. The
tlog utility, the SSSD service and a web console embedded user interface.
tlog utility is a terminal input/output (I/O) recording and playback program. It inserts itself (specifically the
tlog-rec-session tool) between the user terminal and the user shell, and logs everything that passes through as JSON messages.
The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote directories and authentication mechanisms. When configuring session recording, you can use SSSD to specify, which users or user groups should tlog record. This can be done either from a command-line interface (CLI) or from the RHEL 8 web console interface.
The RHEL 8 web console embedded interface
The Session Recording page is part of the RHEL 8 web console interface. The web console embedded interface for session recording enables you to manage recorded sessions.
You have to have administrator privileges to be able to access the recorded sessions.
1.3. Limitations of session recording
Be aware that
tlog does not record terminal in the
Gnome 3 graphical session. Recording terminals in graphical sessions is not supported because a graphical session has a single audit session ID for all terminals and
tlog does not have a way to distinguish between the terminals and prevent repeated recordings.