Re: History Files

[cgrey () WCFAMILY COM (Corwin J. Grey)]

Everyone keeps mentioning process accounting. That works well (and I use it
in addition to appendonly/uneraseable attributes on .bash_history). However,
a history file is much easier to scan through and look for patterns of
activity. Is a user trying to wipe their history file? Why? What are they
trying to hide? Are they ftping lots of files from a site, compiling them,
then erasing the directories? Very odd. Investigate further. Process
accounting show what specific processes a user ran, but it doesn't show what
they tried to run (and failed). Did they try to run showexport (not
installed on our box)? That won't show in psacct. Did they cat the passwd
file? Did they try to cat the shadow file? Patterns more than explicit
programs are important.

I use appendonly history files, process accounting, and hostsentry. Every
single user I've caught trying to root our boxes has been not because a
particular process showed up in process accounting, but because they started
logging in at odd times, and trying to rm their history file.