Question: I've had a few security problems with a server of mine because a few SSH users have been causing problems.

So I would like to:

* Track user logins and logouts
* Track activity of these SSH users, in order to discover any malicious activity
* Prevent users from deleting logs

Answer: 
The ssh daemon, `sshd`, has much of this built in and enabled. Here's are some sample lines from `/var/log/secure` on my machine (names and IP addresses changed):

```
Sep  7 08:34:25 myhost sshd[6127]: Failed password for illegal user root from 62.75.999.999 port 52663 ssh2
Sep  7 08:34:26 myhost sshd[7253]: User root not allowed because listed in DenyUsers
Sep  7 08:34:28 myhost sshd[7253]: Failed password for illegal user root from 62.75.999.999 port 53393 ssh2
Sep  7 11:55:18 myhost sshd[11672]: Accepted password for gooduser from 98.999.26.41 port 43104 ssh2
Sep  7 23:01:28 myhost sshd[22438]: Did not receive identification string from 999.56.32.999
Sep  8 06:31:30 myhost sshd[21814]: Accepted password for gooduser from 98.999.26.41 port 5978 ssh2

```

This example shows a couple attempts by somebody to ssh into this machine as root -- both were denied because root is forbidden. It also shows a successful login by the user named "gooduser". 

To fine tune *what* you see and in *which file*, read more in the [sshd\_config](http://www.openbsd.org/cgi-bin/man.cgi?query=sshd_config) man page -- specifically the options for LogLevel and SyslogFacility.
I wouldn't give out ssh-accounts, especially to distro-groups type people.

Here's a couple of things:

* last, gives you a history of recent login-out's.
* Harden the bash history to prevent wiping out the command history
<http://sock-raw.org/papers/bash_history>

From [Can history files be unified in bash?](https://superuser.com/questions/37576/can-history-files-be-unified-in-bash/37583#37583)

```
Insert the command shopt -s histappend in your .bashrc. 
This will append to the history file instead of overwriting it.
Also in your .bashrc, insert

PROMPT_COMMAND="$PROMPT_COMMAND;history -a; history -n"

and the history file will be re-written and re-read each time
bash shows the prompt.

```