RE: [edlug] Checking Users Bash History

["James E. Jarvis" <jjarvis@xxx.xxx.xxx>]

Devious method (possibly not legal!)

Can you not engineer them to run a shell script of your choice that does

  history > /tmp/username

Now the really devious might replace a binary with something like

#!/bin/sh
history > /tmp/username
exec /path/to/supplanted/binary $*

Note that ls cd etc are probably shell builtins so they won't work.

To cover myself I recommend you ask the users before doing something so
devious.

James

On Tue, 4 May 2004, Peter  George wrote:

>
>
> Looks like I'm out of luck. Thanks for your advice.
>
> :-)
>
> P
>
> -----Original Message-----
> From: Steve Kemp [mailto:steve@xxx.xxx.xxx] On Behalf Of Steve Kemp
> Sent: 04 May 2004 12:15
> To: Peter George
> Cc: Caitlin; edlug@xxx.xxx.xxx
> Subject: Re: [edlug] Checking Users Bash History
>
>
> On Tue, May 04, 2004 at 11:45:31AM +0100, Peter  George wrote:
>
> > What if there is no .bash_history in the users' home directory when
> > you
> > ls- al?
>
>   Then you're out of luck unless you've enabled process accounting ahead
> of time.
>
>   (I always symlink .bash_history to /dev/null on all my machines).
>
> Steve
> --
> -
> ----------------------------------------------------------------------
> You can find the EdLUG mailing list FAQ list at:
> http://www.edlug.org.uk/list_faq.html
>
>

   ----------------------------------
         James Jarvis BSc., PhD
      The University of Edinburgh
            0131 651 3095
    email 'james.jarvis@xxx.xxx.xxx'
   http://www.ucs.ed.ac.uk/~jjarvis/
   ----------------------------------
-
----------------------------------------------------------------------
You can find the EdLUG mailing list FAQ list at:
http://www.edlug.org.uk/list_faq.html