bash auditing

camry · 05-31-2009, 07:06 AM

Hi dear friends
I have an RHEL5 installed and I gave all users on it rbash shell, Now I want to audit all commands that they did in there shell once they enter them, Can any guide me to the way
Thanks

unSpawn · 05-31-2009, 10:36 AM

Check rootsh, a logging wrapper for shells?

fpmurphy · 05-31-2009, 12:50 PM

Look at FreshMeat' BASH for Audit for starters. There are also a number of other variants out there. Basicly what you need to do is make a small modificaton to the bash source code to log all user actions to either a known directory or a centralized logger.

scheuref · 06-06-2012, 06:48 AM

I wrote a method to log all 'bash' commands/builtins into a text-file or a 'syslog' server without using a patch or a special executable tool.

It is very easy to deploy, as it is a simple shellscript that need to be called once at the initialization of the 'bash'.

see the method here: 'http://blog.pointsoftware.ch/index.p...ommand-logger/'

cheers
Francois Scheurer