Re: History Files

[dr () DURSEC COM (Dragos Ruiu)]

On Sat, 15 Apr 2000, Crispin Cowan wrote:
> audit wrote:
>
> > I would like to have what they type logged to /root/history/$user_history
>
> Especially cleaver users intent on hiding will name their modified shell "vi" or "rn" :-)

Especially clever users will just use the real vi, or rn or another program that
allows shell escapes without having to hide anything that can be found.

":!export HISTFILE=/dev/null;...." or ":!ash"

You would have to secure any program that allows user controlled exec's and
remove all compilers, perl interpreters and so on, ad nauseum.

IMHO the process accounting or piping everyone through some sort of logging
ptys would be the only feasible ways to pseudo-reliably do this. Bash_history
is a good aid, but likely a poor primary security mechanism.

cheers,
--dr

--
dursec.com / kyx.net - we're from the future                      http://www.dursec.com
learn kanga-foo from security experts: CanSecWest - May 10-12 Vancouver

Speakers: Ron Gula/NSW, Ken Williams/E&Y, Marty Roesch/Hiverworld,
    Fyodor/insecure.org, RainForestPuppy/wiretrip.net, Theo de Raadt/OpenBSD