5

I have installed rootsh and it's working fine in CentOS 6. But its logs are written both to /var/log/messages and /var/log/rootsh/.

I want the logs to only be written to /var/log/rootsh/, not to /var/log/messages. When I run the command from root, I'm able to disable syslog:

rootsh --no-syslog

I want to be able to disable syslog with my normal user, too. I logged into my normal user and edited .bashrc to add the following line

rootsh --no-syslog

It's creating 225 processes:

[root@testing ~]# ps aux | grep rootsh | wc -l
225

[root@testing ~]# ps aux | grep rootsh | less

code 16521 0.0 0.0 8256 832 pts/1 S+ 14:43 0:00 /usr/bin/rootsh --no-syslog
code 16535 0.0 0.0 8256 816 pts/3 S+ 14:43 0:00 /usr/bin/rootsh --no-syslog
code 16549 0.0 0.0 8256 820 pts/5 S+ 14:43 0:00 /usr/bin/rootsh --no-syslog
code 16563 0.0 0.0 8256 816 pts/6 S+ 14:43 0:00 /usr/bin/rootsh --no-syslog
code 16577 0.0 0.0 8256 820 pts/7 S+ 14:43 0:00 /usr/bin/rootsh --no-syslog
code 16591 0.0 0.0 8256 820 pts/8 S+ 14:43 0:00 /usr/bin/rootsh --no-syslog
code 16605 0.0 0.0 8256 820 pts/9 S+ 14:43 0:00 /usr/bin/rootsh --no-syslog
code 16619 0.0 0.0 8256 824 pts/10 S+ 14:43 0:00 /usr/bin/rootsh --no-syslog
code 16633 0.0 0.0 8256 820 pts/11 S+ 14:43 0:00 /usr/bin/rootsh --no-syslog
code 16647 0.0 0.0 8256 820 pts/12 S+ 14:43 0:00 /usr/bin/rootsh --no-sysl

1 Answer 1

5

What's happening here is that you are getting caught in a loop - have a look at this output from pstree

sshd───bash───rootsh───bash───rootsh───bash───rootsh...

Each time you run bash, it runs .bashrc which runs rootsh which is a wrapper around bash so it runs bash which runs .basrc ...

You could put the invocation in .bash_profile, then it will only run for login shells

~/.bash_profile
      The personal initialization file, executed for login shells
~/.bashrc
      The individual per-interactive-shell startup file

And the output from pstree with this in place

sshd───bash───rootsh───bash───pstree

Don't use rootsh -i though in your .bash_profile.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .