canonical / canonical/auditd-operator
tlog PTY merges stderr into stdout for non-interactive SSH commands
- Dominant language
- Python
- Stars
- 2
- Forks
- 1
- PR merge metrics
- No merged PRs in 30d
Description
## Problem
For session recording, remote commands are executed under a PTY, which is a single stream, so the command's stdout and stderr are merged. On hosts without enablement of session recording, SSH keeps stderr on a separate channel.
Reproduce:
ssh 'echo OUT; echo ERR >&2' # ERR still prints
ssh 'echo OUT; echo ERR >&2' # ERR suppressed
## Impact
Any tooling relying on separate streams is affected on managed hosts. One example is the error when enabling verbose on `sshuttle` command (#40)
Contributor guide
Research direction
Start by tracing how recorded remote commands are launched under a PTY and how their output reaches the SSH client. Reproduce the two SSH examples on recorded and unrecorded hosts, then verify that non-interactive commands preserve separate stdout and stderr without breaking session recording.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- devops, operating-systems
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 50/100