-7

We use CentOS 6/7 we have use script which user are stop that process. So we don't get to see any log from such users.

We want capture following:

  • Timestamp when the user logs in to the OS
  • Timestamp when the user logs out from the OS
  • The activities (keystrokes) of the user during his/her login
  • Terminal IP/Location of the local system from where the user logs in the server

What issues we are facing is from 2K user we have in that people clean they history. After running rm -rf on our production server.

Improve this question
10
  • 7
    Capturing keystrokes is a big security no-no, it means passwords will be stored somewhere, and likely not in a secure way. People might use these passwords elsewhere. Log-in and log-out events should be in the `/var/log/secure log. I think a better approach would be to prevent the people from doing the bad things instead of focusing on who. If you require sudo for stuff, then sudo will log those actions.
    – Kyle Brandt
    Apr 6, 2016 at 13:12
  • 2
    Checkout out auditd
    – Kyle Brandt
    Apr 6, 2016 at 13:22
  • 2
    If you want to log all activity, the file is going to be huge. You cannot both have a log of all activity and have that log not be huge. You must choose to either not log all activity or to not have a small file.
    – Jenny D
    Apr 6, 2016 at 14:06
  • 1
    You dont ask for a wall to be painted black and then complain its too dark. Define what you want, understand the risks and then mitigate the risks. If its too much log data filter it or ship it elsewhere.
    – Matthew Ife
    Apr 6, 2016 at 14:26
  • 2
    Might also consider moving to containers, so 2k people don't have access to a server, just their walled garden.
    – Kyle Brandt
    Apr 6, 2016 at 14:39

1 Answer 1

Reset to default
2

First, if users are able to delete files that they shouldn't delete, you have a bigger problem. File permissions should be set so that regular (non-root) users can not do serious damage. I would first investigate this. If all users use the same account, consider creating an account for each user. Do not give anyone (except the system administrators) the root password.

To capture all output of a single command you can use the script command:

$ script outputfile.txt vi
Script started, output file is outputfile.txt

Script done, output file is outputfile.txt
$

You can view "outputfile.txt" to see everything the user did while using vi.

However I'm not sure how you would use this to capture all output. You could run "script outputfile.txt bash" as their shell, but that doesn't seem to work.

I wrote this script, called it /usr/bin/capture-bash and created a user that had it as its shell. Sadly it didn't work but I don't understand why.

#!/bin/bash

username="${USER:-unknown}"
filename="/var/tmp/${username}.$(date -u +%Y%m%d).log"

echo "START_TIME=$(date -u +%Y%m%d-%H%M%S)" >>"$filename"
echo "IP_ADDRESS=$SSH_CLIENT" >>"$filename"
script -e -q -a "$filename" bash
echo "END_TIME=$(date -u +%Y%m%d-%H%M%S)" >>"$filename"

If this did work, you'd have another problem: the user would be able to delete the file. You could fix that many ways: use a modified version of /usr/bin/login, write the file to a write-only directory https://unix.stackexchange.com/questions/22577 and other techniques.

Improve this answer
2
  • Hey TomOnTime, really appreciate you work, they are multipal group few group have sudo ro su - access to server it that bridge info then only they might delete log file. Few days back one of our team member left org and he has add cron job to server to run rm -rf to few production data. We are checking above bash code in out test setup soon we will update you for the same,
    – Anuj Borhade
    Apr 6, 2016 at 14:54
  • TomOnTIme, we have use your code which work fine, but only issues once user press ctrl+D it will come out to again $ and after that it wont write any thing in log file.
    – Anuj Borhade
    Apr 6, 2016 at 15:03

Not the answer you're looking for? Browse other questions tagged or ask your own question.