Action triggered by illegal applications.

rblampain · 08-08-2005, 10:14 PM

We're planning a server with a strictly limited set of applications. Is there a way to detect the starting of an illegal application or activity on this server and take some action?

Any comment, links, hints most welcome.

Matir · 08-08-2005, 10:16 PM

Why not just remove execute permissions on applications you don't want users executing? You can set up a trusted execution group for those who could use them. If you need more control, you could use ACLs.

primo · 08-09-2005, 12:01 AM

If you want a restricted environment, you may use chroot effectively on a case-by-case basis.

There are many approaches to system monitoring...

There's process accounting. See acct(5) and acct(2)

Matir · 08-09-2005, 12:04 AM

If you want them to have only a restricted shell (if any at all), also set the users shell value to rbash. Look in the bash man page for more details.

rblampain · 08-09-2005, 09:01 AM

Thank you all. It looks like ACL is what I needed, I was unaware of its existence.