Sponsored Content
Full Discussion: Unix keystroke logger
Special Forums Cybersecurity Unix keystroke logger Post 302447383 by mohzub on Monday 23rd of August 2010 02:42:21 AM
Old 08-23-2010
Unix keystroke logger

Hi all,

Does anyone know if there is a tool in the market that could do the following when System Admin log to the server as root and perform activities according to his change request:

- trap or log his keystroke for the entire duration
- provide a report on the changes SA has made to the environment excluding harmless commands ( such as ls, cd, pwd,etc). If the SA execute a script called "ls", the tool should also list out what the script does and what changes has taken place.

Many thanks.
 

10 More Discussions You Might Find Interesting

1. Linux

Keystroke log, eventlog, etc...

Don't you just hate crackers? Ok, I have a user on my server who is always causing trouble. He is constantly trying to get into files, change stuff, get users passwords, etc. I was wondering if Linux has a built in keystroke log, or event log of some sort that I may use to track his movements. ... (4 Replies)
Discussion started by: Phobos
4 Replies

2. UNIX for Dummies Questions & Answers

keystroke trap

Hi, How to track/trap the keyboard strokes in the script say for eg, in normal scene, when a script is running, if a press control c, the program gets terminated... so in this case, how do i trap the keystrokes so as to avoid the abort of the program.. pls help (1 Reply)
Discussion started by: vasikaran
1 Replies

3. UNIX for Dummies Questions & Answers

ldapmodify: keystroke to apply changes

Hi, I need to modify some entries in LDAP, but with what keystroke do I exit and apply the changes? Thanks Brissix (0 Replies)
Discussion started by: brissix
0 Replies

4. Solaris

Monitoring all user keystroke activity

Hello, First post so bear with me....i've done lost of searches on this and did not find a definitive answer. I need to be able to capture in log every single keystroke a user performs, I am aware that the script command can be used to do this, however, here is my dilemma/problem. Here... (1 Reply)
Discussion started by: giles.cardew
1 Replies

5. Solaris

Disabled keystroke at the log-in menu

Hello I am unable to enter my password because the OS does not respond to my keystrokes in the password field at the log-in menu, even though it does in the username field. I have no clue how to troubleshoot this. Please help me out. Thank you (11 Replies)
Discussion started by: dai2809
11 Replies

6. Shell Programming and Scripting

Perl - Reading keyboard keystroke

Hello All, I wounder if any one know if perl have the ability to run script in the background which record each keyboard keystorke? If yes , how can I implement the part which reading the keyboard keystroke? Is there any moudle that handle it ? Thanks a head Alalush (1 Reply)
Discussion started by: Alalush
1 Replies

7. Shell Programming and Scripting

Regarding automatic keystroke

Hi All , I am writing a shell script for a 3D test case . The 3D Test case involves the user to press some keys to see the changes in the 3d test case . The user has to press p , r , a , z etc to observe the changes on screen . Now please let me know how can i implement the keystroke p , a ,... (1 Reply)
Discussion started by: dskonnur
1 Replies

8. UNIX for Dummies Questions & Answers

Capturing the keystroke

i have the below script: #!/bin/bash echo "enter a" read a echo "enter b" read b let c=a+b echo $c at any point of time between entering the value for a and b,if user presses ctrl+a key combination, then it should start from the beginning(the script should be restarted). it should... (4 Replies)
Discussion started by: pandeesh
4 Replies

9. Red Hat

Putty recognise keystroke wrongly!

Putty: release 0.58 Operating system: Linux, release 2.6.36-rc7 Problem: I use Putty to connet to server, initially everthing looks fine but after I browse some files, my keyboard acts funny, like if I keyin "cd", I got "je" on the screen. :wall: This only happens on some existing files but... (4 Replies)
Discussion started by: linwufei125
4 Replies

10. UNIX for Advanced & Expert Users

Keystroke logging issue

I'm having an issue with keystoke logging. As we know in unix you can press tab to auto-complete a command or whatever it is you are typing. Well keystoke logging in /var/log/ks, tabs are actually showing up as tabs rather than whatever the auto-completion was. Any ideas? (5 Replies)
Discussion started by: scj2012
5 Replies
runlevel(7)						 Miscellaneous Information Manual					       runlevel(7)

NAME
runlevel - event signalling change of system runlevel SYNOPSIS
runlevel RUNLEVEL=RUNLEVEL PREVLEVEL=PREVLEVEL [ENV]... DESCRIPTION
This page describes the runlevel Upstart event, and the general implementation of runlevels in the Upstart system. For the runlevel tool, see runlevel(8) The runlevel event The runlevel event signals a change of system runlevel. The new system runlevel is given in the RUNLEVEL argument, and the previous system runlevel in the PREVLEVEL argument (which may be empty). Additional environment may follow these depending on the runlevel, and the tool that emitted the event. The shutdown(8) tool will supply an INIT_HALT variable set to either HALT or POWEROFF when called with -H or -P respectively. Runlevels Runlevels are a concept from UNIX(R) System V used by the init(8) daemon or other system initialisation system to define modes of system operation. Eight runlevels are permitted, the first seven are numbered 0-6 and the eighth is named S or s (both are permitted). Services and other system components are said to exist in one or more runlevels. When switching from one runlevel to another, the services that should not exist in the new runlevel are stopped and the services that only exist in the new runlevel are started. This is performed by the /etc/init.d/rc script executed on a change of runlevel (by jobs run on the runlevel event in the Upstart system). This script examines symlinks in the /etc/rc?.d directories, symlinks beginning K are services to be stopped and symlinks beginning S are services to be started. The authorative documentation for this process can be found in the System run levels and init.d scripts section of the Debian Policy Man- ual. This may be currently found at <http://www.debian.org/doc/debian-policy/ch-opersys.html#s-sysvinit> Runlevels 0, 1 and 6 are reserved. Runlevel 0 is used to halt the system and 6 to reboot the system. Runlevel 1 is used to bring the sys- tem back down into single-user mode, after which the runlevel will be S. System V initialisation in Upstart The compatible implementation of runlevels permits Upstart jobs to be run on the runlevel event that perform the same functionality as the original System V init(8) daemon. The /etc/init/rc.conf job is run on the runlevel event, thus receiving the RUNLEVEL and PREVLEVEL environment variables. Its sole job is to execute the /etc/init.d/rc script, passing the new runlevel as an argument. Initial system startup is provided by the /etc/init/rc-sysinit.conf job. This is run on the startup(7) event, and is primarily responsible for running the /etc/init.d/rc script with the special S argument and calling telinit(8) to switch into the default runlevel when done. This also handles the -b, emergency, -s and single kernel command-line options as well as specifying an alternate runlevel on the kernel command-line. Finally the /etc/init/rcS.conf job handles the special case of entering the single-user runlevel and providing a login shell. Once that shell terminates, this restarts the rc-sysinit job to re-enter the default runlevel. Implementation of runlevels in Upstart The Upstart init(8) daemon has no native concepts of runlevel, and unlike the System V daemon, makes no attempt to keep track of the cur- rent runlevel. Instead a compatible implementation is provided by the runlevel(8), telinit(8) and shutdown(8) tools supplied with Upstart. The telinit(8) and shutdown(8) tools are used by system administrators to change the runlevel, thus they both generate this runlevel event obtaining the value for the PREVLEVEL environment variable from their own environment (the RUNLEVEL variable) or the /var/run/utmp file. Additionally they update the /var/run/utmp file with the new runlevel, and append a log entry to the /var/log/wtmp file. The runlevel(8) tool may be used by system administrators to obtain the current runlevel, this reads the RUNLEVEL and PREVLEVEL variables from its own environment or reads the current and previous runlevel from /var/run/utmp. The who(1) -r command may also be used to read the current runlevel from /var/run/utmp. This provides full compatibility with System V. During the boot scripts, where the /var/run/utmp file may not yet be writable, the RUNLEVEL and PREVLEVEL environment variables will be available so telinit(8) will still provide the correct values. Once the boot scripts have finished, while the environment variables may no longer be available, the /var/run/utmp file will be and the most recent telinit(8) invocation should have successfully written to it. Boot time records The telinit(8) tool also takes care of writing the boot time record to both /var/run/utmp and /var/log/wtmp. This is written if the previous runlevel in these files does not match the previous runlevel obtained from its environment. In general this occurs when switching from runlevel S to the default runlevel, at which point the /var/run/utmp and /var/log/wtmp files are both writable, and the telinit(8) invocation to do the switch has RUNLEVEL=S in its environment. EXAMPLE
A service running in the typical multi-user runlevels might use: start on runlevel [2345] stop on runlevel [!2345] SEE ALSO
runlevel(8) init(8) telinit(8) shutdown(8) who(1) Upstart 2009-07-09 runlevel(7)
All times are GMT -4. The time now is 01:05 PM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy