Disabling the SAM's GUI

[Aldis Black]

Hi All, I recently implemented the keystroke logging for root auditing but I am unable to log the activities in SAM when initiated via dtterm as it starts as GUI. Is it possible to disable the GUI version of sam so all the activities could be logged as in text version?

[Pete Randall]

Sure, simply "unset $DISPLAY" prior to invoking SAM. You could do this in a small script aliased to sam so it would be automatic. If the script were clever enough it would save the contents of $DISPLAY before unsetting, then restore DISPLAY after running SAM.


Pete

[Pete Randall]

However, I'm still not sure that you will be able to intercept and log all the SAM keystrokes because you will still be in a menuing environment. Try it and see, I guess.


Pete

[Steven Schweda]

> [...] simply "unset $DISPLAY" [...]

Uh, "unset DISPLAY", perhaps?

> [...] If the script were clever enough it
> would save the contents of $DISPLAY before
> unsetting, then restore DISPLAY after
> running SAM.

Or, even more clever, don't bother. Setting
the environment inside a shell script has
little effect when that script exits.

> [...] script aliased to sam [...]

Or, aliased to something like "sam", but not
"sam", leaving it no harder to get to the
normal SAM.

[Torsten.]

I doubt if keystroke logging makes any sense with sam, because you will see a lot of up and down and return keystrokes only.

How about having a look into SAMs log files or syslog?