TTY Audit

Disable root Login by changing following line of /etc/ssh/sshd_config

PermitRootLogin no

Execute following command to reload ssh service

service sshd reload

Disable 'sudo su' by changing following line of /etc/sudoers

Cmnd_Alias   NSHELLS = /bin/sh,/bin/bash

Cmnd_Alias   NSU = /bin/su

%Domain\ Admins ALL=(ALL) ALL,!NSHELLS,!NSU

Monitor terminal command executed by user by adding following line at /etc/pam.d/sshd and vim /etc/pam.d/login

# pam_selinux.so close should be the first session rule

session    required     pam_tty_audit.so enable=*

sudo cp /usr/share/doc/audit-2.8.1/auditd.cron /etc/cron.weekly/

You can get report by executing following commands -

aureport --tty