LogAnalysis
[logs] CanSecWest 2008 CFP (deadline Nov 30,conf Mar 26-28) and PacSec Dojo's Nov 09 2007 04:24AM
Dragos Ruiu (dr kyx net) (1 replies)
[logs] How to log - commands and file access Nov 09 2007 08:25AM
david bigot devoteam com (7 replies)
Re: [logs] How to log - commands and file access Mar 03 2008 07:24AM
Cesare (tensi mclink it)
Hy David,

for tracing and intercept all command sent by CLI you can try "sudosh"
or "sudosh2" (the last is new source tree). It work as shell for target
username, every command the user types within the root shell is logged as
well as the output and throught syslog the log-in and log-out.

The "sudosh" (or "sudosh2") shell, after the username log-in on the
system, fork the shell system defined as "default shell" configured into
the config file. I installed it on each system where I installed "sudo"
application.

More on: http://sourceforge.net/projects/sudosh2/

Cesare

david.bigot (at) devoteam (dot) com [email concealed] ha scritto:
>
> Hello,
>
> I want to known for a customer, how to log automatically on UNIX and
> Linux system :
> - all commands executed (in BASH, ZSH & co ...). I know but the file
> ~/.(ba)sh_history but I prefer a global file or through syslog.
> - all file access by process and username in real-time (not static) or
> if it's not possible, which process and username access to some files
> (or directory) like /etc/shadow, /data/ ...
>
> Regards,
> ----------------------------------------------------------------------
> David Bigot - Consultant sécurité
> Apogée Communications - Groupe DEVOTEAM
> 86, rue Anatole France
> 92300 Levallois-Perret
> téléphone: ()1.41.49.58.04
> email: david.bigot (at) apogee-com (dot) fr [email concealed]
_______________________________________________
LogAnalysis mailing list
LogAnalysis (at) loganalysis (dot) org [email concealed]
http://www.loganalysis.org/mailman/listinfo/loganalysis

[ reply ]
Re: [logs] How to log - commands and file access Nov 25 2007 12:48AM
Karl Vogel (vogelke pobox com)
RE: [logs] How to log - commands and file access Nov 12 2007 11:37PM
Kurt Buff (KBuff zetron com) (1 replies)
RE: [logs] How to log - commands and file access Nov 13 2007 10:01PM
David Corlette (dcorlette novell com) (1 replies)
Re: [logs] How to log - commands and file access Nov 13 2007 11:31PM
Matt Cuttler (mcuttler bnl gov)
Re: [logs] How to log - commands and file access Nov 12 2007 02:47PM
Mike Blomgren (mike blomgren tornado se) (1 replies)
Re: [logs] How to log - commands and file access Nov 12 2007 03:15PM
david bigot devoteam com (1 replies)
Re: [logs] How to log - commands and file access Nov 13 2007 04:07AM
Anton Chuvakin (anton chuvakin org)
Re: [logs] How to log - commands and file access Nov 09 2007 08:09PM
Anton Chuvakin (anton chuvakin org) (2 replies)
Re: [logs] How to log - commands and file access Nov 10 2007 03:49PM
James B Horwath (Jim_Horwath glic com)
Re: [logs] How to log - commands and file access Nov 10 2007 02:21AM
James Turnbull (james lovedthanlost net)
Re: [logs] How to log - commands and file access Nov 09 2007 07:38PM
Vincent Bernat (bernat luffy cx)
Re: [logs] How to log - commands and file access Nov 09 2007 07:10PM
Stephen John Smoogen (smooge gmail com)


 

Privacy Statement
Copyright 2010, SecurityFocus