Re: How to track down which commands sudoers set up?

[ascii <ascii () katamail com>]

Jannis Kafkoulas wrote:
> I'd like to find out what exactly any user did after they turned to superuser
> and when exactly each cmd was processed (in a Linux box).

grsec exec logging or manually hook into the kernel

don't relay on bash history (even when chattr immutable it's a very
unreliable way to track user commands)

regards, Francesco 'ascii' Ongaro, http://www.ush.it/