Script Command

[jijujose]

I am using the script command to log whatever the user does after he logs in. I have put the command in his .profile. script -a /tmp/users/user.`date +%d%t` The problem is when he logs in he can see the message - Script started, file is /tmp/users/user.`date +%d%t` Since the script is being executed by his .profile, he can edit the log file & do all the changes. How do i deny the user from editing the script log file

[larsoncu]

isn't there a -q option to surpress that message?

[jijujose]

Where do i put that option -q
its giving

script: illegal option -- q

[Glenn S. Davidson]

Maybe some experimentation is needed here.

I would try to run it from an alias to see if the alias is echo'd instead of the script command. Maybe putting the script command at the top of the copyright/motd so it scrolls off the screen. If you just need the shell history maybe 'tee' would be better?

You might also check the porting archive:

http://hpux.cs.utah.edu/

to see if there is a better solution. I would caution you about the use of these type tools to invade users privacy. There should be a pretty good reason for doing something like this.

[larsoncu]

ooops
sorry there is no -q on hpux, there is on aix

[jijujose]

Thanks Glenn, this is for auditing purposes.
The data is very sensitivie & there are many users who have access to the system.
I tried to change the permission of the dir to root & just give execute permission to the output file. That fails since it should have a write permission for logging activities. Is there any way I can hide the command from getting displayed on the screen wheneve the user logs in. The command is in his .profile so it will execute whenever the user logs in

[larsoncu]

like glen suggested, put it in /etc/profile and not the user's .profile

in profile do something like
if [[ $USER = user ]] ;then
script -a file
clear
fi

copywrite
motd
etc

you could also write to a pipe then create a process that only you can read from it.

using a pipe they wouldn't be able to modify any of the information, but being they would have write permission to the pipe they could feed you bogus information to confuse you.

[larsoncu]

you could also put the script command between stty commands

stty -echo #turn echoing to the screen off
script -a file
stty echo # turn echoing on

[Dennis Handly]

>larsoncu: you could also put the script command between stty commands
stty -echo

This just turns off echoing of user input, not output in general.

Also, when you use script, I think it won't read any other commands after it.

[Tor-Arne Nostdal]

larsconu
- also proposes to run a clear command after script -a
This will neither work, as the clear command won't be executed until the script is terminated (exit or Ctrl+D)

I assume you would need an 'exit' immediately after the script command to ensure that the user simply not exit the script and continous the work in the original login shell

If you want to audit 'what the users do' it might be an option to put a tail on their history file(s). This could run as a continous process from the root user and collect to some audit logfiles.
You will only get their commands - and not all the output (which might be unnecessary anyway).

/Tor-Arne