04-03-2006
this is one possible idea/suggestion,
have a stealth wrapper to your /usr/bin/rm and /usr/sbin/unlink commands
stealth wrapper.
when the commands rm or unlink is executed first the wrapper which contains the underlying base command would be executed.
With that you can log the userid, file being deleted, time of deletion.
its actually you are wrapper script executed first upon invoking rm or unlink system calls. Then the wrapper in turn executes the required command.
This should give you a clue/option to proceed.
10 More Discussions You Might Find Interesting
1. UNIX for Advanced & Expert Users
Hi,
we are using solaris8. we have some files disappear. I would like to know how to track who and when the files was remove ???
thanks, (7 Replies)
Discussion started by: xitrum
7 Replies
2. UNIX for Advanced & Expert Users
dear all,
I'm facing problem that is i have noticed from few days back that some body is deleting and making changes in the file from developement server where i'm working(in unix)
so i want to track that who is using the server, what performancr they are doing and each every thing which r... (5 Replies)
Discussion started by: panknil
5 Replies
3. UNIX for Advanced & Expert Users
Is there a way to track down what process is sending to a certain port? I have some thing pounding the network with requests to a multicast IP that doesn't exist. I have shut down all comms related processes and yet it is still there. Need a way to track the port or IP back to the process. Thanks... (3 Replies)
Discussion started by: mattmanuel
3 Replies
4. Shell Programming and Scripting
I have written a script which checks server load and emails me.
I am running into the error:
./load_alert.sh: line 8: ; then
printf "WARNING - cpu load high in xyz server"
fi (2 Replies)
Discussion started by: vsmurali
2 Replies
5. UNIX for Dummies Questions & Answers
Hi everyone hope you can help me
i have 5 root users and the problem with that is how can you see
witch root user did what on the box how can you track the users that
played on the servers.
1) What commands they typed (in linux you get history )
2) From witch ip did they connect to the server (3 Replies)
Discussion started by: sucram
3 Replies
6. IP Networking
hi,
i'm using tcpreplay to send a traffic trace to my wireless interface (the trace is been captured by the same interface). It seems as netfilter can't trace connections. Is it possible? (0 Replies)
Discussion started by: littleboyblu
0 Replies
7. AIX
Hi All
How can track what commands are entered by the Root user. Is there a log besides using the history command that lists all commands entered for a period of time.
thanks:o (6 Replies)
Discussion started by: pashan
6 Replies
8. Red Hat
I've tried to see what I can find on my own but I'm coming up with goose eggs. Basically I was wondering if there was a way of querying the scheduler (or something similar) to track a process back to a particular CPU it's executing on at the time of the command. ps has a "cpu" output option but... (1 Reply)
Discussion started by: thmnetwork
1 Replies
9. Shell Programming and Scripting
Hello folks,
I am tracking a process httpd only. But when i am grepping it, it is returning me multiple process of httpd, second it is showing another process of monitorix-httpd. Below commands i have tried.
Current output
# ps ax |grep http
929 ? Ss 0:00 monitorix-httpd... (5 Replies)
Discussion started by: learnbash
5 Replies
10. Shell Programming and Scripting
Hi folks,
I have the basic query that there are 3 unix boxes having their individual access now in my team there are 4 members who are using the same credentials to access those 3 boxes through putty ssh from their windows desktop , now if i want to check which 4 members have executed the... (1 Reply)
Discussion started by: punpun66
1 Replies
LEARN ABOUT MOJAVE
git-shell
GIT-SHELL(1) Git Manual GIT-SHELL(1)
NAME
git-shell - Restricted login shell for Git-only SSH access
SYNOPSIS
chsh -s $(command -v git-shell) <user>
git clone <user>@localhost:/path/to/repo.git
ssh <user>@localhost
DESCRIPTION
This is a login shell for SSH accounts to provide restricted Git access. It permits execution only of server-side Git commands implementing
the pull/push functionality, plus custom commands present in a subdirectory named git-shell-commands in the user's home directory.
COMMANDS
git shell accepts the following commands after the -c option:
git receive-pack <argument>, git upload-pack <argument>, git upload-archive <argument>
Call the corresponding server-side command to support the client's git push, git fetch, or git archive --remote request.
cvs server
Imitate a CVS server. See git-cvsserver(1).
If a ~/git-shell-commands directory is present, git shell will also handle other, custom commands by running "git-shell-commands/<command>
<arguments>" from the user's home directory.
INTERACTIVE USE
By default, the commands above can be executed only with the -c option; the shell is not interactive.
If a ~/git-shell-commands directory is present, git shell can also be run interactively (with no arguments). If a help command is present
in the git-shell-commands directory, it is run to provide the user with an overview of allowed actions. Then a "git> " prompt is presented
at which one can enter any of the commands from the git-shell-commands directory, or exit to close the connection.
Generally this mode is used as an administrative interface to allow users to list repositories they have access to, create, delete, or
rename repositories, or change repository descriptions and permissions.
If a no-interactive-login command exists, then it is run and the interactive shell is aborted.
EXAMPLE
To disable interactive logins, displaying a greeting instead:
$ chsh -s /usr/bin/git-shell
$ mkdir $HOME/git-shell-commands
$ cat >$HOME/git-shell-commands/no-interactive-login <<EOF
#!/bin/sh
printf '%s
' "Hi $USER! You've successfully authenticated, but I do not"
printf '%s
' "provide interactive shell access."
exit 128
EOF
$ chmod +x $HOME/git-shell-commands/no-interactive-login
To enable git-cvsserver access (which should generally have the no-interactive-login example above as a prerequisite, as creating the
git-shell-commands directory allows interactive logins):
$ cat >$HOME/git-shell-commands/cvs <<EOF
if ! test $# = 1 && test "$1" = "server"
then
echo >&2 "git-cvsserver only handles "server""
exit 1
fi
exec git cvsserver server
EOF
$ chmod +x $HOME/git-shell-commands/cvs
SEE ALSO
ssh(1), git-daemon(1), contrib/git-shell-commands/README
GIT
Part of the git(1) suite
Git 2.17.1 10/05/2018 GIT-SHELL(1)