5.7. Tools

5.7.1. susshi-play

The susshi-play command replays, converts, or exports recorded interactive session audit logs. It reads the .session and .time audit log files produced by suSSHi Gateway and supports several output modes.

Usage

susshi-play [-v] [-k <key>] <session_file>
susshi-play [-v] [-k <key>] -r | --raw    <session_file> ...
susshi-play [-v] [-k <key>] -t | --ttyrec <session_file> ...
susshi-play [-v] [-k <key>] -w | --html   <session_file> ...

Without an output mode flag, susshi-play replays the session in the terminal in real time at its original speed.

-k, --key <file>: Path to the ED25519 private key file used to decrypt the session. Required when the audit log files are encrypted. If the key is passphrase-protected, a passphrase prompt is displayed.

-r, --raw: Print the raw session content to standard output without timing. Accepts one or more session files.

-t, --ttyrec: Convert the session log into a ttyrec file. The output file is written next to the input file with a .ttyrec extension.

-w, --html, --web: Convert the session log into a self-contained HTML file that can be viewed in any browser. The output file is written next to the input file with a .html extension. Requires TermRecord to be installed.

-s, --suffix: Override the default output file extension.

-v, --verbose: Enable verbose output.

-h, --help: Print usage information.

5.7.1.1. Player Keys Reference

When replaying a session (no output-mode flag), the following keys control playback:

Key	Action
`p`, `s`	Toggle pause
`spc`, `>`	Go forward by one frame
`#>`	Go forward by # frames
`b`, `<`	Go back by one frame
`#<`	Go back by # frames
`#g`	Jump to frame #
`G`	Jump to end
`#G`	Jump to # frames before end
`q`	Quit player
`#x`	Set playback speed to # times
`#X`	Set playback speed to # nth
`x`, `X`	Set playback speed to normal
`l`	Toggle logarithmic time compression
`o`	Toggle on-screen info display
`/`	Search forward
`\`	Search backward
`n`	Search for next occurrence

The command is run within the running container:

Replay an unencrypted session

$ docker exec -it susshi /opt/wasabi/susshi/bin/susshi-play \
    /var/log/susshi/audit/2026/06/21/10.0.0.5/johndoe-20260621-103015-0001-04737-00000.session

Export an encrypted session to HTML

$ docker exec -it susshi /opt/wasabi/susshi/bin/susshi-play -w -k /path/to/private_key \
    /var/log/susshi/audit/2026/06/21/10.0.0.5/johndoe-20260621-103015-0001-04737-00000.session

When decryption is requested, susshi-play locates the .enc sidecar automatically, decrypts the session and timing files to temporary files, and feeds them into the selected output mode. The temporary files are removed after the operation completes.

5.7.2. susshi-decrypt

The susshi-decrypt command batch-decrypts encrypted suSSHi audit log files. Decrypted files are written to a decrypted/ subdirectory next to each input file. The subdirectory is created automatically with mode 0700 if it does not exist.

Usage

susshi-decrypt -k|--key <private-key> <file> [<file> ...]

-k, --key <file>: Path to the ED25519 private key file for decryption. If the key is passphrase-protected, a passphrase prompt is displayed.

-h, --help: Print usage information.

The command accepts one or more encrypted audit log files as arguments. Files ending in .enc (the sidecar files) are silently ignored. susshi-decrypt exits with status 0 if all files decrypted successfully, or 1 if any file failed.

Decrypt a set of audit log files

$ docker exec -it susshi /opt/wasabi/susshi/bin/susshi-decrypt -k /path/to/private_ed25519_key \
    /var/log/susshi/audit/2026/06/21/10.0.0.5/johndoe-20260621-103015-0001-04737-*.session \
    /var/log/susshi/audit/2026/06/21/10.0.0.5/johndoe-20260621-103015-0001-04737-*.time

-> /var/log/susshi/audit/2026/06/21/10.0.0.5/decrypted/johndoe-20260621-103015-0001-04737-00000.session
-> /var/log/susshi/audit/2026/06/21/10.0.0.5/decrypted/johndoe-20260621-103015-0001-04737-00000.time

2 file(s) decrypted successfully.

5.7.3. susshi-who

Users connected via suSSHi can be easily displayed on the gateway using the susshi-who command included in the container. The command line tool is comparable to the well-known Unix commands who or w.

The command is run within the running container to gather all information:

Example output

$ docker exec -it susshi /opt/wasabi/susshi/bin/susshi-who

suID   USER       PID       LOGIN@           IDLE   SESSION-ID                   FEATURES    CLIENT              TARGET (TARGET IP)
0001   user       15        Nov 21 07:38:55  0:00   20181121-073850-0001-04737   I-A-----Z   15.6.4.5:49319   -> user@target3:22 (19.22.33.17)
0001   user       16        Nov 21 07:54:49  0:00   20181121-075449-0001-04760   I-A--L--Z   15.6.12.16:49534 -> root@target1@cloud27:22 (5.6.66.1)

-h, --help: Print usage information.

The meaning of the FEATURE flags is described below.

5.7.4. susshi-last

The command susshi-last allows the administrator to list the last user sessions that have been run on the suSSHi instances running on the local server. It also displays the users that are still logged in.

The command is run within the running container to gather all information:

Example output

$ docker exec -ti susshi /opt/wasabi/susshi/bin/susshi-last
suID   USER       PID      LOGIN@            LOGOUT@         DURATION  SESSION-ID                   FEATURES    CLIENT              TARGET (TARGET IP)
0001   user       15       Nov 21 07:38:55 - Nov 21 07:39:25 (00:00)   20181121-073850-0001-04737   I-A-----Z   15.6.4.5:49319   -> user@target3:22 (19.22.33.17)
0001   user       16       Nov 21 07:54:49 - Nov 21 07:59:11 (00:14)   20181121-075449-0001-04760   I-A--L--Z   15.6.12.16:49534 -> root@target1@cloud27:22 (5.6.66.1)

The susshi-last command takes the following options:

-l, --lastlog: Lastlog filepath, if not set, the environment variable SUSSHI_LASTLOG is expected or default is used

-n, -###, --lines: Number of session, including active and finished sessions, defaults to 20

-h, --help: Print usage information.

The meaning of the FEATURE flags is described below.

5.7.5. Feature Flags

The FEATURE flags have the following meaning:

Flag	Description
A	User has requested Agent-Forwarding
C	User has run SCP on at least one channel
E	User has executed a remote command on at least one channel
F	User has run SFTP on at least one channel
I	User has started an interactive session on at least one channel
L	User has used Local port forwarding
R	User has requested (and may be used) Remote port forwarding
X	User has used at least one X11 forwarding in session
Z	The user session is running ZLib compression