Introduction
Ghost Shell records every shell session on a Linux host, encrypts it at rest, and lets root replay, search, and live-tail from a central store.
Ghost Shell is a terminal session recorder and root audit daemon for Linux. It captures every shell session — including SSH — encrypts it at rest with AES-256-GCM, and gives you a root-only central store you can replay, search, and live-tail.
It ships as one static Go binary, about 3.5 MB, built with CGO_ENABLED=0. No agent, no database, no runtime dependencies.
The problem
When you need to answer "what happened on that box?", the usual tools fall short:
~/.bash_historylies. It is user-writable, drops pipes, and never records output.script(1)writes plaintext that anyone can read.asciinemais built for demos, not audit.
Ghost Shell exists for the case where the answer actually matters.
What you get
| Capability | Details |
|---|---|
| Encrypted at rest | AES-256-GCM. cat, strings, and grep on a recording reveal only ciphertext. |
| Root-only store | Every user's sessions land in /var/lib/ghostshell (root:root 0700). Users cannot read anyone's recordings — not even their own. See audit mode. |
| Real replay | Full-screen player: seek, pause, variable speed, jump-to-command, original timing. See replay. |
| Live tail | Watch a session as it happens: ghostshell tail -f <id>. See live tail. |
| Search everything | Grep across every recording on the host, with natural-language date filters like --from "2 days ago". See search. |
| Fail-open | If the daemon is down, busy, or out of disk, recording falls back to a local file and is ingested later. It never blocks a login and never silently loses a session. |
| Single static binary | Ships as .deb / .rpm with a hardened systemd unit. See installation. |
Ghost Shell is built to be deployed unattended: security-audited, race-tested, staticcheck and golangci-lint clean, and systemd-hardened (systemd-analyze security rates the daemon 3.9 OK).
Warning: Ghost Shell is an audit and visibility tool, not a tamper-proof enforcement boundary. A determined user with shell access can start a shell that was never wrapped. Read the security model before relying on it — knowing exactly where the boundary sits is part of the product.
Where next
- Install Ghost Shell from a package, static binary, or source.
- Record your first session in under two minutes.
- Skeptical? Start with the security model or the FAQ.