Skip to main content

Viewing session recordings

Viewing Session Recordings​

Every session through a gateway is recorded. Recordings are shown on the Session Recordings page. A recording appearing here is the only positive proof that a session actually opened, because every refused connection looks identical from the client.

Open Session Recordings​

Session Recordings is not in the sidebar. You reach it from the item you want to review (open Switch product → PAM first):

  • An endpoint: go to Targets → Endpoints and click the icon in the Recordings column of the endpoint's row. The page opens filtered to sessions recorded on that endpoint.
  • An endpoint user (account): go to Targets → Endpoint Users, open the row's actions menu and select View Session Recordings. See How to view a session recording for an endpoint user.
  • A logged session: on Auth Logs, click the play button on an SSH row to open its recording directly.

Click Back at the top of the page to return to where you came from.

Terminal tab​

The Terminal tab lists terminal recordings. Use the filters at the top to narrow the list:

Format -> SSH gateway (asciicast) or Web terminal (typescript). Only one format is listed at a time. Filter by -> Endpoint user, Target host, Target account or User, then pick or type a Value Search -> Free-text search

Target host and Target account are exact matches: a partial host name or account matches nothing. If you know a session happened but the list is empty, switch the Format first.

Each recording shows:

Recording -> Play, to replay the session Session ID -> The session's ID, with a copy button Operator -> The person who ran the session, or "Unattributed" if no registered SSH key matched Target host -> The address the gateway connected to Target account -> The account used on the endpoint Endpoint -> The endpoint User -> The user's email address Identity -> How the operator's identity was established Presence -> How the operator's presence was confirmed Size -> Size of the recording Session time -> When the session was recorded

The Session ID is also written to the endpoint's own /var/log/auth.log (as authnull-sshproxy:<id>:<account>), so you can match a recording to the endpoint's logs.

Play a recording​

Click Play on a recording. The recording opens on its own Session recording page with a player, the session ID and an integrity badge:

  • Integrity intact: the recording still matches what AuthNull received when the session ended.
  • Integrity: altered: the recording has changed since it was received. The details are shown above the player.
  • Integrity unknown: integrity could not be confirmed.

Integrity details are shown below the player. Click Back to return to the list.

Screen tab​

The Screen tab lists screen recordings from the earlier web-terminal flow. Filter by Endpoint user, Endpoint or User, and click Play to watch a recording.