Want monitor program

[kenlo]

Anyone know what kind of program can monitor user behaviour. For example, log what command user type in the unix sheel.

[Radhakrishnan Venkatara]

hi,

i think there is an option when u r using trusted systems where u can specify which command should be logged. but i haven't used it.

u can use script command , u can put it the .profile file in the user home directory.

this will log each everything including the results displayed in the particular termimnal.

note:- log file will be huge.

radhakrishnan

[Balaji N]

first, why would you want to do that and eat into an user's privacy.


the easiest approach is to give a shell which has history features (csh, ksh, tcsh, etc) and then the set the history size to say 1000 or more and then take a backup of the history file on a regular basis.

hth
-balaji

[Michael Tully]

There is the general '.sh.history' file, but the problem is the user has read/write access to it.
The only foolproof method is to set up system as trusted and you can audit actual events. The only other method is to set up accounting/auditing, but beware of the disk space utilisation. Have a look at the man page for audsys.

[kenlo]

It is secure unix machine. Just allow few administrators to do some tasks. They also agree to capture the input command for record.

[Balaji N]

then ok. go ahead. setup a cron job to copy the history files periodically.

hth
-balaji

[Giada Bonfà]

hi
try to see user .sh_history or set this feature by inserting:

HISTFILE=/"user home directory"/.sh_history

HISTSIZE=1000 --> number of user cmd that you can see.

export HISTFILE HISTSIZE

[harry d brown jr]

Common sense tells one that users should NEVER have access to shell's! They have a job to do and that should be done via applications and these applications should do their own monitoring!

THere is absolutely no valid reason for a "user", and I'm not talking about developers or systems people, I'm talking about "users" to need access to shells. If a "user" thinks they do need access to shells, then you need to modify or create applications to assist them, but by all means they MUST be kept out of shells! It's the first rule of security!

Do you ever get audits.


live free or die
harry