Audit logging (key stroke capturing) in x windows

[wip]

Hi Guys,

Would you suggest a way to enable auditing (key stroke logging) for x windows in HP Unix.Any built in Hpux function or products available

thanks
wip

[Arunvijai_4]

http://docs.hp.com/en/5991-1821/index.html
[HP-UX 11i Security Containment Administrator's Guide] should help you..

-Arun

[RAC_1]

What exactly you are trying to do??
Do want to look at commands used by user, then you can look at history file(ususally .sh_history in home directory)

You can also look at script command. But this is very space consuming and these files gro very quickly.

[wip]

Guys,

thanks for the initial response.

My intention is to capture the key strokes(commands executed) by the users ,from admins to normal users for security auditing

thanks
Wip

[RAC_1]

On windows?? If on unix, as mentioned above look at .sh_history file or command script.

If window$, then there are fre/paid keyboard loggers....

[Arunvijai_4]

You can either set history option..

(Assign points if replies are useful)

-Arun

[TEC-HP]

if you're using bash as a shell:
adapt your /etc/syslog.conf and ad:
local5.info @loging_server

the loging_server receives all interactive command-logging (UDP)

check the bash source-code (.../lib/readline/history.c, function "add_history()"

As such when the logging-server is properly hardened: that history cannot be tampered (as the local .history can)

Note: if the user performs shell-escapes or uses another shell: the commands in this new shell won't be logged

[Steve Lewis]

The script command will capture terminal screen i/o at the shell command as well as commands typed in.

man script

You can start it up in your .nnnrc file or .profile like this:

trap "echo 'logout' ; cd /work/logs; gzip -S .$$.gz myLOG; exit" 0
script /work/logs/myLOG
exit

It will not help you trap passwords, graphics or mouse actions, I don't condone that sort of nefarious activity anyway.

[Muthukumar_5]

You have to use script / tee utlity to log all commands typed with results.

hth.

[Matti_Kurkela]

Keystroke logging for X windows???

The graphical environment makes it difficult. You must capture the user event streams separately for each application/window, otherwise your log is not going to be very reliable. Remember that the user can use the mouse to switch between applications at any time.

(If you capture the keystrokes for all the windows in one stream, it is easy to trick you: just type "rm -f", switch to another window, type four backspaces and "ls -l", switch back to the first window and add a filename. The log will show you executed "ls -l filename" when you actually did a "rm -f filename".)

If you need auditability, you can get more meaningful results with application-level logging. Analyzing an OS-level log will often be major detective work with uncertain results. With a GUI application, you'd need to figure out what was written into which field and whether the thing under the mouse when the user clicked was "OK", "Cancel" or something else entirely.

A properly-designed logging function in an application might produce a log event "at time T, userid A placed in the system an order for X units of product P for client C"... which would be exactly the kind of information you need.

Keystroke logging is useful if the user interface is simple and strict enough so that the actual event can reliably be reconstructed from the logs. With a GUI environment, this is not necessarily true.

Consider what you're collecting the logs for: is it just to satisfy an abstract bullet point or is it so you can provide a 100% conclusive answer when some authority (big boss, police, government official...) requires it from you?

[Don Mallory]

XKey will do it. You have to ruin the underlying security of using .Xsession files and run the system open (xhost +), but this will catch every keystroke enterred by a terminal. Keep in mind, if it's open for you, it's open for EVERYONE.

http://www.deter.com/unix/software/xkey.c

This page has a lot of useful tools an information.

You can also check out this article from the SANS Reading Room:

X Windows Security: How to Protect your Display
http://www.sans.org/rr/whitepapers/unix/328.php

.sh_history files are your best bet.

SysAdmin Magazine has an article on capturing root's history, there are a few scripts associated. You could modify them to cover every user if you wanted:

The article is called in the "Intrusion Detection" section and is called:

Root Access Intrusion -- A Suite of Tools
http://www.samag.com/documents/s=9389/sam0208c/

Good luck.
Don