Sponsored Content
Full Discussion: .bash_history
Top Forums UNIX for Advanced & Expert Users .bash_history Post 28337 by Neo on Tuesday 17th of September 2002 10:09:27 AM
Old 09-17-2002
The way to proceed is to develop (or use exisiting) a wrapper program around the user login that logs all standard-in from keyboard, and logs this information securely so the user cannot modify.

I wrote a C program called 'keylog.c' that does just this for an HP-UX platfrom that did some very critical transactions and had users logging in from all over the world to debug real-time and near-real time errors.

The program basically wrapped around the user shell and logged all the keystrokes, with timestamps a the beginning of the login session and one at the end, of the user. The process could be killed by the user, but if a use attempted to kill the logging program, the program trapped the kill signal and would kill all child processes. If you can imagine this, this means that the user killed or attempted to kill the logging program, the user would be immedately logged out because his shell would die immediately.

BTW: None of this is performed with HISTORY and other shell functions. These are not reliable and were not designed for security, tracing nor auditing.

Worked great and the platform received insurance certification from LLoyds of London, which meant that enough security controls were in place to reasonably insure (not perfect, but good enough to insure combined with other controls).

I disagree with an earlier comment that 'if you don't trust users, don't let them login'..... they are simply too many production servers that require tracing and logging. Trust is relative and most mistakes that cost companies the biggest money are not from malicious activities, they come from well intended users who make honest mistakes. Those user makes must be traceable (to the user) and auditable in many applications.


(BTW: None of what I describe above is accomplished with shell history files like .sh_history, etc. Those files are not designed for real security applications.)
 

8 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

Change .bash_history to another one

we need the help to change .bash_histroy file in root ,(i.e) we want to save the histroy for .temp.txt for permenently. how to do?? Help us (1 Reply)
Discussion started by: thakshina
1 Replies

2. UNIX for Advanced & Expert Users

.bash_history

During the course of the session before I logout I see some of the commands listed from my previous session but not from my current session and after I logout and log back in I see the commands which I ran before logging out. Does the .bash_history stay in the buffer or someplace else then? ... (2 Replies)
Discussion started by: jacki
2 Replies

3. Shell Programming and Scripting

.bash_history

Dear All, I am creating users on our servers. the .bash_history supposed to store all the commands entered by the user. My question is, how can I prevent the user himself from editing or viewing this file? I have tried chaning the owner of the .bash_history to be the root user but... (5 Replies)
Discussion started by: charbel.n.s
5 Replies

4. UNIX for Advanced & Expert Users

.bash_history modification

Hi Experts, I know my question would be strange but i need to understand how the .bash_history file is logging user actions (the mechanism) and if possible modify it to include also the date/time of every action done by the user. Sample file: # more .bash_history ssh <IP address> -l axadmin... (3 Replies)
Discussion started by: Dendany83
3 Replies

5. UNIX for Dummies Questions & Answers

how to store time in .bash_history file

Hi - user commands are written in . bash_history of that user when he logs out. my bash_history file shows. not sure what that number means #1329618972 ls -la #1329618978 ls #1329618980 ls -la my bash_profile looks like this PATH=$PATH:$HOME/bin export PATH export... (3 Replies)
Discussion started by: oraclermanpt
3 Replies

6. UNIX for Advanced & Expert Users

How to recover .bash_history?

rm -rf .bash_history some one ran rm -rf .bash_history on my Linux server(SUSE),I can see this command being run in current history, but I want the OLD history as well,can I recover the old history back. (9 Replies)
Discussion started by: Ankit Bansal
9 Replies

7. Shell Programming and Scripting

Display .bash_history with timestamp using script

Hi would like to ask if there is anyway to display .bash_history with timestamp using shell script? i know that you should use history command with HISTTIMEFORMAT="%d/%m/%y %T " to display it in terminal but it does not work when i use it on shell script. It seem that you can't run history... (1 Reply)
Discussion started by: pikamon
1 Replies

8. UNIX for Beginners Questions & Answers

How to get the "history" command to show all that is in the .bash_history file?

I am using the bash shell. When I view my recent command history using the "history" command from the prompt, it only shows me the commands starting at #928. The commands I need are earlier than that, but I can't figure out how to make the other 927 display. They are in my .bash_history... (1 Reply)
Discussion started by: Twinklefingers
1 Replies
Net::DNS::Question(3pm) 				User Contributed Perl Documentation				   Net::DNS::Question(3pm)

NAME
Net::DNS::Question - DNS question class SYNOPSIS
"use Net::DNS::Question" DESCRIPTION
A "Net::DNS::Question" object represents a record in the question section of a DNS packet. METHODS
new $question = Net::DNS::Question->new("example.com", "MX", "IN"); Creates a question object from the domain, type, and class passed as arguments. RFC4291 and RFC4632 IP address/prefix notation is supported for queries in in-addr.arpa and ip6.arpa subdomains. parse ($question, $offset) = Net::DNS::Question->parse($data, $offset); Parses a question section record at the specified location within a DNS packet. The first argument is a reference to the packet data. The second argument is the offset within the packet where the question record begins. Returns a Net::DNS::Question object and the offset of the next location in the packet. Parsing is aborted if the question object cannot be created (e.g., corrupt or insufficient data). qname, zname print "qname = ", $question->qname, " "; print "zname = ", $question->zname, " "; Returns the domain name. In dynamic update packets, this field is known as "zname" and refers to the zone name. qtype, ztype print "qtype = ", $question->qtype, " "; print "ztype = ", $question->ztype, " "; Returns the record type. In dymamic update packets, this field is known as "ztype" and refers to the zone type (must be SOA). qclass, zclass print "qclass = ", $question->qclass, " "; print "zclass = ", $question->zclass, " "; Returns the record class. In dynamic update packets, this field is known as "zclass" and refers to the zone's class. print $question->print; Prints the question record on the standard output. string print $qr->string, " "; Returns a string representation of the question record. data $qdata = $question->data($packet, $offset); Returns the question record in binary format suitable for inclusion in a DNS packet. Arguments are a "Net::DNS::Packet" object and the offset within that packet's data where the "Net::DNS::Question" record is to be stored. This information is necessary for using compressed domain names. COPYRIGHT
Copyright (c) 1997-2002 Michael Fuhr. Portions Copyright (c) 2002-2004 Chris Reinhardt. Portions Copyright (c) 2003,2006-2009 Dick Franks. All rights reserved. This program is free software; you may redistribute it and/or modify it under the same terms as Perl itself. SEE ALSO
perl(1), Net::DNS, Net::DNS::Resolver, Net::DNS::Packet, Net::DNS::Update, Net::DNS::Header, Net::DNS::RR, RFC 1035 Section 4.1.2 perl v5.14.2 2009-12-30 Net::DNS::Question(3pm)
All times are GMT -4. The time now is 06:33 AM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy