Server History

hhh123 · 11-04-2011, 08:10 AM

HI All,

have a server with me which is managed by me and more 5 ppl, my main problem is that , i can't find who is doing what using history command. And this thing happen when all ppl login by using same credential and at the same time.

NOTE :- All users are using same username and password.

TenTenths · 11-04-2011, 08:58 AM

First, give everyone their own username and password, multiple people using the same login is bad practise.
Second, lock them down to bash shell.
Third, add this to your /etc/profile to log every command used to /var/log/messages

Code:

function log2syslog
{
   declare command
   command=$(fc -ln -0)
       if [ "${command}" != "" ]
       then
   logger -p local1.notice -t bash -i - $USER:"${command}"
       fi
}
trap log2syslog DEBUG

Good luck.

goossen · 11-04-2011, 09:04 AM

Having several people using the same user/password at same time is not a good idea.

That said, there are some commands may help you.

I'm assuming you are using bash, which by default, updates its history only on exit.
To solve this you can set the shell option histappend, causing all new history lines to be appended, and avoiding that multiple logins overwrite each other's history.

Code:

shopt -s histappend

To ensure that history is written after each command. You can may add "history -a" to the PROMPT_COMMAND variable. This variable contains a command to be executed before any new prompt is shown, and is therefore run after every interactive command is executed.

Code:

PROMPT_COMMAND="history -a"
export PROMPT_COMMAND

Additionally, you can increase the history size (default is 500)

Code:

unset HISTFILESIZE
HISTSIZE=10000
export HISTSIZE

You can add these commands to your ~/.bashrc

hhh123 · 11-04-2011, 12:11 PM

First of all thank you so much for reply and great useful guidelines "TenTenths goossen". I know its not good practice to use one username and password with many ppl..but due to some business requirement i need to share that root's password.