The UNIX and Linux Forums  


Go Back   The UNIX and Linux Forums > Special Forums > Security
.
google unix.com




View Single Post in the UNIX and Linux Forums - Click on the Thread or Permalink to View Entire Thread -->
  #6 (permalink)  
Old 10-21-2008
Reboot's Avatar
Reboot Reboot is offline
Registered User
  
 

Join Date: Sep 2008
Location: Asia Pecific.
Posts: 31
Hi.. Smiling Dragon You are right......
It would be a bit tough to distinguish one session from another when two people logged in as root at the same time....

So, for that I have a solution......
First make Sure that you have sufficient space in / then do following :

1. Make a directory /record.
2. Put following entries in /.bashrc file:
x=`tty | cut -c 6- |tr '[/]' '[.]'`
if [ ! -d /record ] ; then
mkdir -p /record
fi
if [ ! -f /record/$x ] ; then
touch /record/$x
fi
echo >> /record/$x
echo " *********************************** " >> /record/$x
echo >> /record/$x
script -a /record/$x

Now, when anyone will log in to the system each time you are going to get his commands recorded to /record/pts.# file along with time and date of login. Where "#" is the terminal number given by tty command.The commands will get appended to this file (not over written).

So, you will have to monitor these files in /record directory regularlly so as to limit their size and growth.
No doubt you will have to set default shell as Bash.

Hope this will help.....

Cheers.... ......

Last edited by Reboot; 10-21-2008 at 05:56 PM..