log every keystorke of a user

[njia_1]

Hi

Is there a way to log absolute every keystorke of a user ? for example, user root.

thanks

[Alexander Chuzhoy · Accepted solution]

what about `history` command?
You have the commands saved in .bash_history
inside home directory. I assume you use bash.

[Steven E. Protter]

shalom njia

HISTFILE=/root/.bash_history
HISTSIZE=5000
export HISTFILE HISTSIZE

Its standard in the bash shell. .bash_profile

SEP

[njia_1]

Hi

Thanks for your reply, history file does not do the job I want.

History files only has record of all the commands, what I want to do is to record all the keystorkes, including typing errors. The log will happen on both local and a remote log host. History files can be deleted and modified easily.

thanks

[Joseph Loo]

hi,

if u got $$$, take a look at this:

http://www.symark.com/powerbroker.htm

else, another way is to use the script command which u define in the user's profile. "man script" for more detail.

regards.
(p.s. wat happen to the post u started on "interesting...")

[Steven E. Protter]

Okay, you are going overboard.

The HISTFILE logs mistakes if enter is hit.

This level of monitoring, if applied to all users can impede performance. If only for root, the HISTFILE is a good enough tool.

Good Luck,

SEP

[Huc_1]

Hello Nija

If what you need is to log everything for someone you gave priv to "like root for install of a product/applic" you can ask then to use something like the following.

ssh 'hostname' | tee install_product.log

every modification will be in the install_product.log and if you keep an eye on the content of last and use command stat you will be able to figure out if the file has been edited/modified after log out.

Hope this is helps.

Jean-Pierre Huc

[Ivan Ferreira]

If you want to really log absolutly ALL keystrokes, you can use the script command.

You can also configure auditing, take in account that if you configure the HISTORY variables, root can easily modify that configurations.

[Bill Thorsteinson]

There is a package which allows you to
snoop the tty. Highly invasive though.

[Alan_152]

do a google for "linux keylogger"... lots of good ones are listed...