Results 1 to 5 of 5

Thread: Logging all commands

  1. February 25th, 2003, 01:48 PM #1
    DalamarArgent
    DalamarArgent is offline
    Junior Member
    Join Date
    Feb 2003
    Posts
    6

    Exclamation Logging all commands

    Good Afternoon Everyone.

    As most are aware, on the majority of *Nix Systems, all accounts have a history file that logs what they type.

    The problem I have with this, is that certain users connect, then SU to other users, and issue commands. History does not differentiate between those that logged in as the account and those that su-ed to the account.

    Is there any way of logging these?
    Can a connection history be logged to one file, no matter if they su-ed to another account?

    Any help, suggestions, tips are most welcome.

    Thanks
    Pink ribbon scars, That never forget
    I tried so hard, To cleanse these regrets
    My angel wings, Were bruised and restrained
    My belly stings
    Reply With Quote Reply With Quote
  2. February 25th, 2003, 02:01 PM #2
    the_JinX
    the_JinX is offline
    Leftie Linux Lover the_JinX's Avatar
    Join Date
    Nov 2001
    Location
    Beverwijk Netherlands
    Posts
    2,534
    I don't think that can be done..

    But then again.. what do I know
    ASCII stupid question, get a stupid ANSI.
    When in Russia, pet a PETSCII.
    Get your ass over to SLAYRadio the best station for C64 Remixes !
    Reply With Quote Reply With Quote
  3. March 19th, 2003, 09:56 AM #3
    DragonCurve
    DragonCurve is offline
    Junior Member
    Join Date
    Jan 2003
    Posts
    1
    not by default.. although you could code an LKM to log keys pressed, but this is messy. when a user su's to another account, the history will go into that account's history file.
    Reply With Quote Reply With Quote
  4. March 19th, 2003, 10:12 AM #4
    xmover
    xmover is offline
    Banned
    Join Date
    Mar 2003
    Posts
    32
    you can use keylogger if your want. try www.invisblekeylogger.com
    Reply With Quote Reply With Quote
  5. March 19th, 2003, 11:22 AM #5
    MrLinus
    MrLinus is offline
    Just a Virtualized Geek MrLinus's Avatar
    Join Date
    Sep 2001
    Location
    Redondo Beach, CA
    Posts
    7,323
    Actually, there is something that's being used by the HoneyNet Project. And it's a special bash shell keylogger.

    This patch relies on syslogd.

    http://www.honeynet.org/papers/honey...ols/bash.patch

    This second patch doesn't. The keystrokes can be sent elsewhere via UDP, ensuring that if the localhost's syslog get's pooched there still is a record of activity.
    http://www.honeynet.org/papers/honey...sh-anton.patch
    Goodbye, Mittens (1992-2008). My pillow will be cold without your purring beside my head
    Extra! Extra! Get your FREE copy of Insight Newsletter||MsMittens' HomePage
    Reply With Quote Reply With Quote
« Previous Thread | Next Thread »

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

Forum Rules