Shell Programming and Scripting

Dear All,

I need to restrict the users in our server.

1.History & history -c command working all groups & others.So i need to restrict history -c option for groups & others .

2.Any option available to view user activity with all[username, time stamp, command name etc]
Eg--->user1 Jul22 10:20:11 date

3.Any other Special restriction if you have please reply me

First of all, what shell are you using?

Ad 1. For bash, there is a HISTFILE env var, that is usually set to ~/.bash_history, and thus is kept separate for each user. It sounds like your history file is shared among users...

Ad 2. I don't have a specific way of how to accomplish this fine granularity of logging, but some ideas that you could further follow:
- Try to set up ~/.bash_logout to append $HISTFILE to some global history file.
- Set up a trap (in e.g. /etc/profile) that gets executed when user logs out and harvest history this way:

Code:

trap 'cat $HISTFILE >> /tmp/hist.all ;exit 0' 0

- use 'w' command to get an idea of who's logged in and what they are doing, from cron

Disabling erasing of history -- first I though that could be done through /etc/sudoers, but history is a builtin....

Sorry I am not of more help, but I thought I might help with some brainstorming...

Further to mirni, what Operating System and version are you running?
Please also post the output from:

Code:

echo $HISTFILE
type history

[root@server ~]#echo $HISTFILE
/root/.bash_history


[root@server ~]# type history
history is a shell builtin

Hmm... It seems that HISTFILE is set to ~/.bash_history, as by default.
And you are saying that all users can see each other's history? Can you please double check on this?
I mean, since root's history file is /root/.bash_history, no other user has read permissions for that.

Can you please log in as a non-root user and post the output of

Code:

echo $HISTFILE

for this user.

Thanks mirni,

I got conclusion for that deleting history.The output shown for root user like this & other user can't view this $cat /root/.bash_history

#1311599934
ls
#1311602542
ifconfig
#1311602545
export HISTTIMEFORMAT='%F %T '
#1311602549
history
#1311602595
vim /home/admin1/.bash_history
#1311602604
cat /home/admin1/.bash_history
#1311602876
history -a
----

One more doubt

i already export the history format is export HISTTIMEFORMAT='%F %T '[with date & month] & i got the output like this

1019 2011-07-25 19:41:47 cat /root/.bash_history
1020 2011-07-25 19:42:29 echo $HISTFILE
1021 2011-07-25 19:48:48 cat /root/.bash_history
1022 2011-07-25 19:51:52 history
-----
what is my doubt is any possible to view the other user access with date through history.I tried to view particular user access like admin1 for cat /home/admin1/.bash_history .It shown output like this only

mkdir test1
#1311603452
ls
#1311603457
mkdir testnew
#1311603465
cd /var/backup/
#1311603470
mkdir demo
#1311603501
>> But unable to view date & time.please guide this

The integer is the epoch time. If you have gawk, then this should change it to Y-M-D m:S format:

Code:

$ echo  1311602876 | awk '{print strftime("%Y-%m-%d %M:%S",$0)}'
2011-07-25 07:56