Is there a way to prevent users from changing or unset their HISTFILE variable?

abefroman · 09-12-2009, 09:57 PM

Is there a way to prevent users from changing or 'unset'ting their HISTFILE variable?

TIA

jacknelson · 09-13-2009, 05:46 AM

Users usually use the following to remove all traces of their activity

killall -9 syslogd klogd (kill loggers)
unset HISTFILE (stop .bash_history records)
I see that logs are usually stored in /var/log/messages and /var/log/secure

This doesn't mean you can't have the logs sent to another box or to a printer, etc through a background process.

So if you don't find a way to prevent users to unset their HISTFILE then I recommend you backup(dump) the HISTFILE value every now and then and if it is unset you will have the backup which you can check for more info.

abefroman · 09-13-2009, 08:47 AM

Thanks, I'm talking about for an underprivileged user though.

They shouldn't be able to stop the syslogs.

fpmurphy · 09-13-2009, 10:44 AM

In general, there is no way of stopping users from changing their own shell variables including HISTFILE.

abefroman · 09-13-2009, 10:47 AM

Would this work?

Code:

chmod 700 unset
chmod 700 set
chmod 700 export

Are there any others?

catkin · 09-13-2009, 11:09 AM

Quote:

Originally Posted by abefroman

Would this work?

Code:

chmod 700 unset
chmod 700 set
chmod 700 export

Are there any others?

No. chmod works on files but

Code:

c@CW8:~$ type unset set export
unset is a shell builtin
set is a shell builtin
export is a shell builtin

fpmurphy is right, even the restricted shell doesn't restrict changing HISTFILE. Bash' history mechanism is a convenience for the user. It was not designed as an audit trail and cannot be effectively used as one. If you want to track what commands your users are running, you will have more success with a tool designed for the job.

abefroman · 09-13-2009, 11:23 AM

Quote:

Originally Posted by catkin

No. chmod works on files but

Code:

c@CW8:~$ type unset set export
unset is a shell builtin
set is a shell builtin
export is a shell builtin

Wow, I didn't even know there were shell builtins, I always thought it was /bin/unset or something. I just double checked, and you are right.

I am assuming the shell builtin override whats in $PATH, correct?

catkin · 09-13-2009, 11:41 AM

Quote:

Originally Posted by abefroman

I am assuming the shell builtin override whats in $PATH, correct?

Correct. See the Gnu Bash Reference's Command Search and Execution section for the full story.