Thread Tools Search this Thread
Top Forums UNIX for Advanced & Expert Users .bash_history
# 1  
Old 10-28-2001

Question for all sysadmins.
How do you keep track of what commands each user uses on his account. I thought an easy way is to monitor .bash_history, however those files can be "edited" by the user.
Is there a permission combination that will allow the shell to record to it but yet they can't edit it.

# 2  
Old 10-30-2001
You can use process accounting... check the man page for accton for more details.
# 3  
Old 11-02-2001
You can't really have a person updating a file like .bash_history and then disallow them to edit it (both actions require write premissions). Unfortunately Unix doesn't have as finely granuated file permissions as some other OS's. If you need to audit users activities you need an accounting program that logs targeted activities.

As a suggession perhaps you could run a cron job from root every minute or so to copy any changes to the .bash_history files to a secured directory. I haven't done this personally but it seems feesible.
# 4  
Old 11-06-2001
Well, what if the user did this:

mv .bash_history .junk; ln -s /dev/null .bash_history

If the directory was writable, you may be able to do this even if the file wouldn't normally able to do this...

Also, if the user made that a hard link, the cronjob would always copy a null file...

Also, bash will usually not write out the history until the log out of the shell...

accounting is the best thing I can think of...
# 5  
Old 11-06-2001
Certainly points to the accounting solution once again, espcially if you have a savy user who knows he is being monitored in this way. Of course, the user would need to suspect that he was being monitored in this way, but sometimes what seems unlikely happens and I can see this taking place.
# 6  
Old 11-06-2001
History is certainly useless since it's under control of the user. I looked in my bash book at saw:
...HISTCONTROL variable. If set to ignorespace, any commands that you type that start with a space won't appear in the history.
And there are many other ways to defeat history including typing "sh" and running a bourne shell for awhile.

I hate to be a party pooper, but accounting is also easily defeated. But why bother? Suppose your accounting records shows that I did:
vi perderabo.c
cc perderabo.c -o perderabo
rm perderabo.c perderabo

OK, now what did I do?

Some versions of unix have C2 level security features. You can configure them to track every system call invoked by every user. This puts a nasty load of the system though. Short of this, you aren't going to be able to reliably track what users do.
# 7  
Old 11-06-2001
Hmm,...maybe I'm missing something here, but if you don't want your users to edit that file, why not just change ownership of the file to root, allow read and execute access only.

Just an idea.

Login or Register to Ask a Question

Previous Thread | Next Thread

8 More Discussions You Might Find Interesting

1. UNIX for Beginners Questions & Answers

How to get the "history" command to show all that is in the .bash_history file?

I am using the bash shell. When I view my recent command history using the "history" command from the prompt, it only shows me the commands starting at #928. The commands I need are earlier than that, but I can't figure out how to make the other 927 display. They are in my .bash_history... (1 Reply)
Discussion started by: Twinklefingers
1 Replies

2. Shell Programming and Scripting

Display .bash_history with timestamp using script

Hi would like to ask if there is anyway to display .bash_history with timestamp using shell script? i know that you should use history command with HISTTIMEFORMAT="%d/%m/%y %T " to display it in terminal but it does not work when i use it on shell script. It seem that you can't run history... (1 Reply)
Discussion started by: pikamon
1 Replies

3. UNIX for Advanced & Expert Users

How to recover .bash_history?

rm -rf .bash_history some one ran rm -rf .bash_history on my Linux server(SUSE),I can see this command being run in current history, but I want the OLD history as well,can I recover the old history back. (9 Replies)
Discussion started by: Ankit Bansal
9 Replies

4. UNIX for Dummies Questions & Answers

how to store time in .bash_history file

Hi - user commands are written in . bash_history of that user when he logs out. my bash_history file shows. not sure what that number means #1329618972 ls -la #1329618978 ls #1329618980 ls -la my bash_profile looks like this PATH=$PATH:$HOME/bin export PATH export... (3 Replies)
Discussion started by: oraclermanpt
3 Replies

5. UNIX for Advanced & Expert Users

.bash_history modification

Hi Experts, I know my question would be strange but i need to understand how the .bash_history file is logging user actions (the mechanism) and if possible modify it to include also the date/time of every action done by the user. Sample file: # more .bash_history ssh <IP address> -l axadmin... (3 Replies)
Discussion started by: Dendany83
3 Replies

6. Shell Programming and Scripting


Dear All, I am creating users on our servers. the .bash_history supposed to store all the commands entered by the user. My question is, how can I prevent the user himself from editing or viewing this file? I have tried chaning the owner of the .bash_history to be the root user but... (5 Replies)
Discussion started by: charbel.n.s
5 Replies

7. UNIX for Advanced & Expert Users


During the course of the session before I logout I see some of the commands listed from my previous session but not from my current session and after I logout and log back in I see the commands which I ran before logging out. Does the .bash_history stay in the buffer or someplace else then? ... (2 Replies)
Discussion started by: jacki
2 Replies

8. UNIX for Dummies Questions & Answers

Change .bash_history to another one

we need the help to change .bash_histroy file in root ,(i.e) we want to save the histroy for .temp.txt for permenently. how to do?? Help us (1 Reply)
Discussion started by: thakshina
1 Replies
Login or Register to Ask a Question