topic Re: How to Keep track user activity in Linux in Operating System - Linux

How to Keep track user activity in Linux

Md. Minhaz Khan — Mon, 27 Jul 2009 02:32:29 GMT

Dear concern,

Is there any way to keep track user activity in the command line? I have implemented this by adding following lines in the ".bash_profile" file:

touch ~/Session/command_in_session_`date "+%y%m%d(%H:%M)"`
cat ~/.bash_history >> ~/Session/command_in_session_`date "+%y%m%d(%H:%M)"`
echo " " > ~/.bash_history

But is there any way to implement user level Auditing in Linux from which we can tracking user activity??

Thanks
Minhaz

Re: How to Keep track user activity in Linux

Steven E. Protter — Mon, 27 Jul 2009 08:30:07 GMT

Shalom,

Standard.

Set variables HISTORY and HISTSIZE

That creates keyboard logs.

http://secureaudit.sourceforge.net/

http://www.sans.org/score/checklists/AuditingLinux.doc

http://www.linux.com/archive/feature/114422

SEP

Re: How to Keep track user activity in Linux

Court Campbell — Mon, 27 Jul 2009 14:17:06 GMT

I like ossec.

http://www.ossec.net/

When setting things like this up you want to define what you are looking for. Logging all user activity is kind of pointless. Do you really want to know that they changed a directory? Probably not. Good luck!

Re: How to Keep track user activity in Linux

Ivan Ferreira — Mon, 27 Jul 2009 16:28:22 GMT

You could use "screen" to catch all user session. You can use auditd to audit the commands executed or file access.

Re: How to Keep track user activity in Linux

Victor Semaska_3 — Mon, 27 Jul 2009 16:49:55 GMT

There's also sudosh.

http://sourceforge.net/projects/sudosh/

Re: How to Keep track user activity in Linux

Md. Minhaz Khan — Tue, 28 Jul 2009 11:24:51 GMT

Dear court

I have already install HIDS server and Agent in my linux box. Can uou help me in detail what you have implemented in your production

Thanks
Minhaz

Re: How to Keep track user activity in Linux

dirk dierickx — Mon, 03 Aug 2009 08:16:19 GMT

check out Laus, it's included by default with RH, a guide can be found on the RH knowledge base;

http://kbase.redhat.com/faq/docs/DOC-6613