Pardon my 51yo brain, but I seem to remember that every ssh login is logged?
Yes, auth.log if my memory serves.
Yes, auth.log if my memory serves.
I saw on another page that audit logs are sent off server, presumably append-only, but can Teleport pause execution until after log replication is verified?
For plain logs this would be straightforward, but for enhanced logging I suppose it'd be a matter of deciding when to pause execution, e.g. after downloading a file.
It logs the actual session data, and if "enhanced" recording is enabled, it uses BPF tracing to record all processes executions and files that were opened.
fwiw, the web ui is optional. Nobody's taking away your ssh client.
Their audit log can include a lot more in a more structured format, including wire activity and even std{in,out,err}.