Re: process accounting

From: Anders Gustafsson (andersg_at_0x63.nu)
Date: 05/27/03

  • Next message: Mike Lockhart: "Re: more on linux hardening" 
    Date: Tue, 27 May 2003 20:58:45 +0200
To: Craig Holmes <Leusent@link-net.org>

    On Mon, May 26, 2003 at 08:27:07PM -0400, Craig Holmes wrote:
    > > There is a patch for bash which makes bash logs everything
    > > that is typed (I don't remember the url, search for bash+logging+patch).
    > I have written a very basic patch for bash 2.05b which logs everything which
    > would normally be written to your .bash_history file to a single remote file
    > (No matter what a person does the master file is still written too). It is
    > pretty rough and I used it only briefly in a honeypot exercise, though you
    > may find it usefull.
    > http://gearbox.gearbolt.net/files/patches/bash-masterhist.diff

    There is a program called snoopy too:
    http://sourceforge.net/projects/snoopylogger/
    It logs all execve() calls to syslog. It's installed in /etc/ld.so.preload
    so it only works with dynamically linked programs, but most are. 

    -- 
Anders Gustafsson - andersg@0x63.nu - http://0x63.nu/
  • Next message: Mike Lockhart: "Re: more on linux hardening"

    Relevant Pages

    • Re: monitoring shell commands (recording username/cmd/time)
      ... > I'm wondering if there is a version of bash or tcsh that logs all commands ... I've used it myself some time ago on a shell server and it works ...
      (freebsd-isp)
    • Re: Sniffing on SSH providing private key
      ... because usually all logs (including the bash ... >history) are being deleted after an intruder leaves! ...
      (comp.security.ssh)
    • Re: some ssh connections not logged
      ... Rudy Gevaert schrieb: ... ssh uid@hostname bash ... You can try a wrapper login shell for that user, which logs the SSH-environment or use a tool like ash as login-shell, which logs all activity. ...
      (comp.unix.solaris)
    • Re: Bug in bash ?
      ... Subject: Bug in bash? ... just logs you out on bash 2.05.1, no core dump. ...
      (Vuln-Dev)
    • Re: process accounting
      ... > There is a patch for bash which makes bash logs everything ... I have written a very basic patch for bash 2.05b which logs everything which ... AthlonXP 1800+ AuthenticAMD GNU/Linux ...
      (Focus-Linux)