up vote 4 down vote favorite
share [g+] share [fb]

I'm running a debian etch server where users will be logging into (hopefully) a chroot jail through ssh. How can I have the commands they execute logged in a way they cannot delete, nor prevent?

link|improve this question
58% accept rate
see this question serverfault.com/questions/8851/… – hayalci Jul 13 '09 at 20:04
feedback

5 Answers

up vote 7 down vote accepted

install snoopy. If you only want to log the one user, do some syslog filtering fu.

link|improve this answer
I want to log every user. – Malfist Jul 13 '09 at 18:20
Then just install it, it'll "just work" (TM) – Cian Jul 13 '09 at 19:01
can I set it to log somewhere besides /var/log/auth.log? – Malfist Jul 13 '09 at 19:48
It goes to syslog, so you can filter it to wherever from there, iirc. I've only ever done anything with syslog-ng, so I've no idea about filters with regular syslog I'm afraid. – Cian Jul 13 '09 at 20:40
feedback
up vote 2 down vote

You may try ttyrpld. It's more than you want because it will log the whole tty.
I haven't used it myself but the way it's working (in kernel) makes that user can't alter logs.

link|improve this answer
cool, I'll check it out. If it plays nice with everything it'll be what I need. I can change it's log files to append-only just to make sure – Malfist Jul 13 '09 at 17:55
Cian answer using snoopy seems to be more like what you are looking for. – radius Jul 13 '09 at 18:11
feedback
up vote 0 down vote

You could enable system auditing.

link|improve this answer
and how does one do that? – Rory Jan 22 '10 at 15:11
Start with the man pages for auditd and go from there. It might not be part of the base Debian install, but the audit facility is a Linux kernel component, so the userland tools can be installed and used on any distribution. – Geoff Fritz Jan 22 '10 at 18:24
feedback
up vote 0 down vote

Use a grsecurity patched kernel. There is a kernel option exactly for this purpose.

link|improve this answer
feedback
up vote -2 down vote

bash keeps a command history of a specified size. You the admin can set that size, and easily write a script which goes and fetches that history per user via cron.

link|improve this answer
.bash_history is for convenience, not for security. There a number of reasons for this, not the least of which being that it's user-editable (or at least appendable). – Matt Jul 13 '09 at 18:43
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.