UNIX for Advanced & Expert Users

Question for all sysadmins.
How do you keep track of what commands each user uses on his account. I thought an easy way is to monitor .bash_history, however those files can be "edited" by the user.
Is there a permission combination that will allow the shell to record to it but yet they can't edit it.

Thanks!

You can use process accounting... check the man page for accton for more details.

You can't really have a person updating a file like .bash_history and then disallow them to edit it (both actions require write premissions). Unfortunately Unix doesn't have as finely granuated file permissions as some other OS's. If you need to audit users activities you need an accounting program that logs targeted activities.

As a suggession perhaps you could run a cron job from root every minute or so to copy any changes to the .bash_history files to a secured directory. I haven't done this personally but it seems feesible.

Well, what if the user did this:

mv .bash_history .junk; ln -s /dev/null .bash_history

If the directory was writable, you may be able to do this even if the file wouldn't normally able to do this...

Also, if the user made that a hard link, the cronjob would always copy a null file...

Also, bash will usually not write out the history until the log out of the shell...

accounting is the best thing I can think of...

Certainly points to the accounting solution once again, espcially if you have a savy user who knows he is being monitored in this way. Of course, the user would need to suspect that he was being monitored in this way, but sometimes what seems unlikely happens and I can see this taking place.

History is certainly useless since it's under control of the user. I looked in my bash book at saw: And there are many other ways to defeat history including typing "sh" and running a bourne shell for awhile.

I hate to be a party pooper, but accounting is also easily defeated. But why bother? Suppose your accounting records shows that I did:

Code:

vi perderabo.c
cc perderabo.c -o perderabo
./perderabo
rm perderabo.c perderabo

OK, now what did I do?

Some versions of unix have C2 level security features. You can configure them to track every system call invoked by every user. This puts a nasty load of the system though. Short of this, you aren't going to be able to reliably track what users do.

Hmm,...maybe I'm missing something here, but if you don't want your users to edit that file, why not just change ownership of the file to root, allow read and execute access only.

Just an idea.

VJ