You’re not the customer. Any organization that has sufficiently large has a need to know who is accessing what, and when.
Tools like this help manage all that when you could have hundreds of logins a day.
Tools like this help manage all that when you could have hundreds of logins a day.
Yes, auth.log if my memory serves.
It logs the actual session data, and if "enhanced" recording is enabled, it uses BPF tracing to record all processes executions and files that were opened.
fwiw, the web ui is optional. Nobody's taking away your ssh client.
Their audit log can include a lot more in a more structured format, including wire activity and even std{in,out,err}.
I saw on another page that audit logs are sent off server, presumably append-only, but can Teleport pause execution until after log replication is verified?
For plain logs this would be straightforward, but for enhanced logging I suppose it'd be a matter of deciding when to pause execution, e.g. after downloading a file.