Remote Access session audit for remote access security

This page is for administrators who need to know who connected to which host, when, why and with what permissions. It explains what Remote Access records, where to find it in the Admin Console, and the limits of that record. It does not cover setting a resource up; see Remote Access to SSH, RDP and VNC hosts.

Who can do this. Any administrator with the Super admin, Application admin, Security audit reader or Read-only admin role can read sessions, requests and timelines. Only a Super admin can end a session with Terminate.

What is needed first. At least one Remote Access resource that somebody has opened or requested. Nothing has to be switched on: recording the audit trail is not optional and cannot be turned off.

The result. You can answer, for any session: who opened it, on which resource, through which Gateway, when it was authorized, started and ended, why it ended, what it was allowed to do, and what it did with the clipboard and files. For any request: who asked, for what, for how long, why, and who decided it.

The examples use the fictional company Acme Corp, the employee Maria Lopez and a server called Acme Build Server (SSH).

What is recorded

For every access request

Fact	Where it comes from
Who asked, for which resource, and when	The request itself
The reason, exactly as the requester wrote it (10 to 500 characters)	Required on every request
The duration asked for and, if any, the start time asked for	The request form
The extra capabilities asked for (“Also asked for”)	The request form
Who decided it, when, and the note they left for the requester	The approver’s decision
Which capabilities were approved (“Approved with” or “Approved without extra capabilities”)	The approver’s decision
The state: Pending, Approved, Denied, Withdrawn, Expired or Revoked	Changes as the request moves on
Who revoked approved access, and why	The Revoke dialog in the console

For every session

Fact	Where it is shown
Person, Resource, Gateway	Session detail
Authorized (when SSOGEN allowed the connection) and Started (when the host accepted it)	Session detail
Capabilities the session had, or “None”	Session detail
Hard limit (when the session must end at the latest)	Session detail
Ended, with the Gateway’s reason in words, for example “The session ended normally.” or “The session was idle for too long.”	Session detail
Terminate requested: when, by whom, the reason, and whether the Gateway confirmed it	Session detail, after an administrator ends a session
Whether the host’s identity was verified, and the host key or certificate fingerprint the host presented	Timeline, on the row The host presented its identity
The terminal size or desktop size, and later resizes	Timeline, rows Session active and Resized
Bytes sent to and received from the host, and the duration	Timeline, row Session ended
Every clipboard use: direction, number of items and size	Timeline, row Clipboard used
Every file transfer: direction, size, the first characters of the file’s SHA-256 digest, and the outcome (Completed, Canceled, Refused, Too large)	Timeline, row File transferred
Every attempt to use something the session did not allow	Timeline, row Blocked: not allowed for this session

For the resource itself

Changes an administrator makes are recorded with the administrator’s name and, where the console asked for one, the reason: Resource changed, Access settings changed, Capability settings changed (with the reason the administrator wrote), Stored account set, Stored account removed, Key generated, Host test requested, Host identity trusted by an administrator, Host no longer verified, confirmed by an administrator, Remote access origin changed and Remote access origin removed.

What is not recorded

No screen recording, keystroke recording or session playback. SSOGEN records events about a session, never its content. There is no setting that turns content recording on.
No clipboard text, file contents or file names. A clipboard event carries the direction, a count and a size; a file event carries the direction, the size, the outcome and a digest of the file. Nobody can read from the audit trail what was pasted or which file was moved.
No passwords or keys. A stored account appears in the record as “set”, “removed” or “released to the Gateway for one session”, never with its value. A generated key appears only by the fingerprint of its public half.
No host address on a timeline. A session timeline names the resource, not the host or port behind it.

Where to read it

Live and recent sessions

In the Admin Console, choose Secure access > Remote Access.
Open the Live sessions tab. The table has the columns Person, Resource, Gateway, State, Started and Time left.
The State filter starts on Live. Change it to Authorized, not yet started, Active, Ending, Ended, Never started or Any state to see other sessions. You can also filter by Resource, by Gateway group and by person.
Select Refresh to reload, and Show older to page back through earlier sessions (50 at a time).
On a row, open the row menu and choose Open. The session detail page is headed with the person and the resource, for example Maria Lopez on Acme Build Server (SSH), and lists the facts in the table above. Below them, the heading Timeline shows every event of this session, oldest first.

The same sessions, limited to one resource, are on that resource’s Sessions tab: choose Secure access > Remote Access, open the resource, then Sessions.

The history of one resource

Choose Secure access > Remote Access and open the resource.
Open the Timeline tab. It lists everything that happened to the resource and on it, oldest first: requests, decisions, settings changes, stored-account changes, host trust changes and every session’s events.
Narrow it by person, or by From and To dates. Show older loads the next 100 rows.

Each row shows the date and time, the event in plain words, “(did not succeed)” when it failed, and the person it concerns. Detail lines beneath a row give the facts recorded for it, for example “Host identity: verified”, “Reason: Fix failing nightly build 4412”, “Access: just in time”, “Direction: Out of the host”, “Size: 2.1 MB” or “Outcome: Completed”.

When nothing has happened yet, the tab says No events yet (“Events appear here as the access is requested, used and ended.”).

Requests

Choose Secure access > Remote Access and open the Requests tab (or a resource’s own Requests tab).
The table has the columns Requester, Resource, State, Reason, Asked for, Requested and Decided by. Under the reason, a line says what extras were asked for and what the approver granted.
Filter by State to find, for example, every denied request.

The audit trail

Every Remote Access event is also in the system audit trail, together with everything else that happens on SSOGEN, and can be exported from there.

Choose Monitoring > Audit. The page is headed Audit trail.
Set From (UTC), Until (UTC) and, if you know it, Who did it. Under Result, choose Succeeded, Failed or Denied, or leave Any result.
Open Advanced filters and enter an Area to keep only Remote Access events:

Area	What it covers
`remote_access`	Access requests and their decisions, access settings changes and the Remote access origin
`remote_resource`	Changes to a resource, its stored account, generated keys, host tests and host trust
`remote_session`	Terminate requests made by an administrator
`remote`	What the Gateway reported about sessions: authorizations, connections, host identity, sign-in, clipboard, files, and how each session ended

Select Search. The table lists When, From, Who, What and Result. Select a row to open its details, including Correlation id (shared by every event of one request) and Event type.
To keep a copy, select Export CSV or Export JSON. An export holds at most 1,000 events; if more match, the page says so and the file has the newest 1,000. Narrow the dates to export the rest.

End a session

Only a Super admin can do this.

On Live sessions, open the row menu of an Authorized or Active session and choose Terminate.
The dialog Terminate this session? says: “Maria Lopez’s session on Acme Build Server (SSH) will be ended. The Gateway closes it when it next checks, usually within seconds. The reason is recorded with who ended it.”
Enter a Reason (required) of up to 500 characters and select Terminate session.
The session detail then shows Terminate requested with the time, your name and the reason, followed by “Ending…”, then “Ended, confirmed by the Gateway”. If the Gateway does not report back, it says “Not confirmed by the Gateway”.

The person sees “An administrator ended this session, or your access was withdrawn.” on their session page.

Check it worked

Open any ended session from Live sessions with the State filter on Ended: the detail shows Started, Ended with a reason, and a Timeline that begins with Authorization issued and ends with Session ended.
On a resource’s Timeline, a session that used the clipboard or moved a file has a Clipboard used or File transferred row with a direction, a size and an outcome, and no text or file name.
In Monitoring > Audit, a search with Area remote over today’s dates returns the same session’s events.

Troubleshooting

What you see	What it means	What to do
“No sessions yet”	Nobody has opened a resource.	Nothing to do.
“No sessions match these filters”	The State filter is on Live and no session is running, or another filter excludes everything.	Set State to Any state or clear the other filters.
“The timeline could not be read.”	The console could not load the events.	Reload the page. If it repeats, check the Gateway and SSOGEN are running.
A session shows Authorized but never Active, and later Never started	The person was allowed to connect but the connection did not reach the host.	Open the session: the timeline says whether the Gateway refused it, the host could not be reached or the host’s identity did not match.
“Not confirmed by the Gateway” after Terminate	The Gateway did not report the end within its usual window.	Check that the Gateway is running and connected. The session is refused on the next check anyway.
Security signal badge on a timeline row (“Reported by the Gateway for an authorization SSOGEN did not issue to this group”)	A Gateway reported a session SSOGEN did not authorize for that Gateway group.	Treat it as an incident: find out who holds that Gateway and why it reported the event.
“Your role can view this but not change it.”	Your role may read sessions but not end them.	Ask a Super admin to terminate.
“No audit events match … Widen the dates or clear a filter.”	The Area or dates exclude every event.	Check the Area spelling in the table above and widen the dates.
“An export holds at most 1000 events. More events match than an export holds…”	The search matched more than one export carries.	Export several narrower date ranges.