Session recording
Privilege Secure can record the sessions that users start through an access policy. Administrators and auditors watch the recordings live or replay them later. See Watch, lock, or terminate a live session and Replay a recorded session.
Recording settings
The connection profile on the access policy controls recording. These settings are in the Proxy section of the profile, and the website audio setting is in the Website section. See Connection profiles.
| Setting | Effect |
|---|---|
| Record Proxy Session | Records the session so that an administrator can watch it live or review it later |
| Record Keystrokes and Metadata | Records keystrokes and metadata. When you clear it, the session video is still recorded. |
| Record Session Audio | Records the computer audio during the session |
What is recorded
| Session type | What the recording holds |
|---|---|
| RDP | The session video. Keystrokes and metadata are included when Record Keystrokes and Metadata is on. Windows events are included when the Remote Desktop Monitor service runs on the target host. |
| SSH | The input and output of the session. Keystrokes are included when Record Keystrokes and Metadata is on. |
| Website | A video of the browser session, captured by the browser extension. Audio is included when Record Session Audio is on. |
For SSH, the proxy can also record commands that run without an interactive shell and SFTP file operations. Both are off by default. The settings are in sbpam_ssh.json on the proxy server, in C:\ProgramData\Stealthbits\PAM\ProxyService.
| Setting | Default | Effect |
|---|---|---|
RecordExec | false | Records commands that run without an interactive shell, for example ssh <user>@<proxy> "<command>" |
RecordSFTP | false | Records SFTP file operations |
RecordLimit | 65536 | Caps the recorded size, in bytes, of a single channel |
An upgrade keeps your copy of this file. The proxy service picks up changes to sbpam_ssh.json without a restart. The new settings apply to SSH sessions that start after you save the file.
In an RDP recording, the replay replaces keystrokes that the target marks as password input with *. In an SSH recording, keystrokes are recorded as typed, including anything you type at a password prompt. The SSH recording doesn't mask password input. Don't type secrets at a prompt in a recorded SSH session unless you are sure that recording them is acceptable.
To capture Windows events in RDP recordings, install the Remote Desktop Monitor on the target hosts. See Install the Remote Desktop Monitor.
Where recordings are stored
The proxy service stores recordings on the proxy server, in the iolog folder under the proxy data folder. The default location is:
C:\ProgramData\Stealthbits\PAM\ProxyService\iolog
A service node first writes the recording of each session it handles to this folder. About once an hour, the node copies finished recordings to an application server. Once a recording is copied, a node that doesn't store recordings deletes its own copy. Every Privilege Secure application server stores recordings, including each application server in a cluster. A remote service node doesn't. After replication, a remote service node's recording is kept on an application server, in that server's iolog folder. Protect this folder on every application server and include it in your backups. To move it, for example when the drive runs low on space, see the Knowledge Base article Changing the Path Where Session Recordings Are Stored.
Recording retention
Recordings stay on disk until you delete them or turn on log retention for recordings. In System Settings, the Data Retention panel has Enable I/O Log Retention and I/O Log Retention Days. The option is off by default and the default is 90 days. When you turn it on, Privilege Secure deletes recordings older than the number of days you set. Deletion removes the recordings and doesn't archive them.
Each service node reads the setting from the console and applies it to the recordings in its own recordings folder, so the cleanup runs on every node that holds recordings. Retention deletes RDP and SSH recordings (.iolog files) on each node during the hourly cycle and when a session's recording is handled. This setting doesn't remove website recordings. The proxy service copies each website recording into its recordings folder, then deletes the temporary file it received from the browser extension. Website recordings kept on an application server stay on disk until you delete them.
For all retention settings, see Configure data retention.
To stop keystroke and metadata logging for all sessions, see the Knowledge Base article Disabling Keystroke Logging. That change applies to new sessions only and doesn't remove existing recordings. The same article describes how to delete existing recordings for a time window by hand.
Remote sessions in the browser
Users of the Remote Access Gateway portal start sessions in the browser. Recording and command restrictions still apply to these sessions. The portal doesn't offer replay, so view the recordings in the console.