step-ssh-ctl session runs via PAM. It registers the beginning and end of a login or sudo session with the Smallstep API, and exits. It reads from PAM_USER, PAM_TYPE, PAM_TTY, PAM_RHOST, and PAM_RUSER to gather user metadata. It also reads from /proc/sys/kernel/random/boot_id and /proc/self/sessionid to get the boot ID and session ID.