Originally posted by deadCenter
suppose the user is not physically located nearby for me to check his .bash_history, then how do i go about checking the commands he executed on my machine? If I use ssh also, how can I find out what all commands he executed in on my machine?
AFAIK it should still be logged in the .bash_history file. If they are using a valid bash shell thru telnet, ssh, etc, and .bash_history is enabled in which I do believe Redhat is default with it enabled, then it's all being logged there, like I mentioned before.