Infrastructure / Security · 2026
argus-tty
A lightweight SSH session recorder for Linux fleets that captures terminal sessions for audit purposes and ships as a native Ubuntu package for straightforward fleet-wide deployment.
The problem
Session auditing tools are often heavyweight agents or require bespoke SSH configuration per host, which makes fleet-wide rollout slow and error-prone, especially across hosts with drifted configuration.
The solution
Built a small Go binary that wraps the PTY layer to record sessions to append-only log files, packaged as a native .deb distributed through a PPA so it installs and upgrades through the system package manager like any other tool.
Architecture
A systemd-managed daemon intercepts PTY allocation for SSH sessions and streams terminal I/O to rotated, compressed log files on disk, with a companion CLI for replaying recorded sessions.
Results
- Deployed fleet-wide via standard apt upgrade workflows
- Removed the need for bespoke per-host SSH auditing configuration
- Session replay used directly in security incident investigations