Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I know all commands user sends to server are automatically logged into ~/.bash_history

I want to give access to my PC to my colleague (I've already gave hime some limited access to use sudo via /etc/sudoers), even that i trust him, i would love to reliably know what did he done on my PC - so i need to be sure:

  • his ~/.bash_history cannot be compromized (he cannot truncate or somehow change the file)
  • he cannot change critical env variables, which would affect logging - like HISTCONTROL, HISTFILE or HISTSIZE
  • he cannot run something like history -c

I don't know if i forgot something, but i just need to be sure, that after i come to PC, i will see everything what he has done.

share|improve this question
2  
Have a look at the answers to this question. –  Iain Jul 10 '11 at 20:42
    
@lain Thank you, anyway i actually don't need to log everything - the colleague will have access only through SSH, no X Server, no GUI etc. I think just securing user bash history should be enough in my case. –  Radek Simko Jul 10 '11 at 20:49
1  
I very much doubt that securing the history in the way you suggest is possible: he could always start a subshell with different options, open and close multiple terminal windows so that they overwrite the single history file, and so on. The auditd approach may capture more than you need but at least it might actually work. –  OrbWeaver Jul 10 '11 at 20:56
    
There isn't a sure way to know what a user does thru bash. Bash isn't a logging utility. I've provided an answer that shows how to do things like protect the .bash_history and env variables. As others have commented, there are many ways to keep your commands out of bash history. –  Chris Ting Jul 10 '11 at 21:11
    
Bash history is there for comfort (search/execute already typed command) not logging. What you are asking is to add airbags to your rolling couch so you can go on the road :-p –  shellholic Jul 11 '11 at 9:30
add comment

1 Answer

up vote 8 down vote accepted

Harden bash_history and bash configuration files by making them append-only:

chattr +a /home/user/.bash_history
chattr +a /home/user/.bash_profile
chattr +a /home/user/.bash_login
chattr +a /home/user/.profile
chattr +a /home/user/.bash_logout
chattr +a /home/user/.bashrc

Harden env variables by adding the following lines to /home/user/.bashrc:

shopt -s histappend
readonly PROMPT_COMMAND="history -a"
readonly HISTFILE
readonly HISTFILESIZE
readonly HISTSIZE
readonly HISTCMD
readonly HISTCONTROL
readonly HISTIGNORE

histappend tells bash to append the last $HISTSIZE lines to the $HISTFILE file when an interactive shell exits. PROMPT_COMMAND executes the given command prior to issuing each prompt. history -a appends the command typed just before the current one to $HISTFILE.

Disable access to other shells:

chmod 750 csh
chmod 750 tcsh
chmod 750 ksh

share|improve this answer
2  
Shouln't bashrc and similar config files be immutable instead of append only mode? –  bbaja42 Jul 10 '11 at 21:20
    
Will this configuration still log the commmand if there was a space at the start? E.g. ` echo bla` ; history . Note the space before the echo. –  bbaja42 Jul 10 '11 at 21:26
    
@bbaja42: The configuration files could be made immutable. The tradeoff is the you've locked the user out of things such as setting other bash env variables or other shell customizations which might be allowed. –  Chris Ting Jul 10 '11 at 21:26
    
@bbaja42: The things I've mentioned won't affect if bash logs commands that start with a space. As I understand it, how bash handles logging commands that start with a space is dependent on the bash version. It's not something I've played with, and now I'm curious if that's a setting you can change in bash. –  Chris Ting Jul 10 '11 at 21:35
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.