1

I've noticed that when running a script that connects to a number of our servers (to essentially run batch commands) that the commands aren't logged in the user's .sh_history or .bash_history files. Is there a place where this is logged (assuming the script itself isn't doing the logging and I'm not tee'ing the output anywhere)?

I'm talking specifically about AIX, but I would assume this question applies to all the *nix flavors. Thanks!

1 Answer 1

3

The .*_history files are modified when you run an interactive shell. In your case, a remote server logs into this box and runs a script and exits process, but does not invoke an interactive shell. Hence no command logging.

Even if this is not a remote server, think about the situation below:

You are at the shell prompt and run these commands in succession

# ls -l
# grep $(whoami) /etc/passwd
# netstat -rn

and when you look back into the shell history, you will see these commands there. Now, put all 3 comands into a shell script and name it as "collect_data.sh", chmod it to make it executable, and execute it by issuing # ./collect_data.sh

when you look back into your shell history, what do you see? Those three command or just ./collect_data.sh? I bet dollars to your pocket lint that, it is the latter.

When you invoke a shell script, regardless of whether it's done local or remote, you are creating a sub-shell, where commands run under. Those shells, being non-interactive, have no way of writing to your history file(s). Of course this is short of recompiling your shell executable in a weird way to allow such activity, but why would anyone do that?

Since you asked this question, I am under the impression that you are thinking something sinister might be happening by someone executing remote commands without you knowing about them. If this is the case, you need help from something like tripwire or alike, auditing applications. Just by looking at shell history, even commands existed there, you can not prove anything.

Hope this helps

1
  • 1
    Right now it's more about confirming the commands have been executed, but certainly the last part of your post plays into this question as well. Also, you are correct that the .sh_history only shows the script that's been run instead of all the commands it's calling. Thank you for the information, much appreciated.
    – Dan Wolfe
    Nov 16, 2012 at 16:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .