Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have to maintain a system (debian) on which several users are allowed to install programs - so I would like to log, for example, if anyone executes "apt-get install" or "apt-get purge", so I can keep track of manually installed packages..

I'm looking for a general way to achieve this; it's not just APT, but several programs/scripts etc.

Any ideas?

/edit

a google-search with few different keywords brought up this:

http://serverfault.com/questions/201221/how-to-log-every-linux-command-to-a-logserver

http://stackoverflow.com/questions/15698590/how-to-capture-all-the-commands-typed-in-unix-linux-by-any-user

http://sourceforge.net/projects/rootsh/

share|improve this question

2 Answers 2

Maybe this can work for your needs, if the users uses sudo for installing packages try this:

$ sudo cat auth.log | grep sudo(or apt-get or any other program/script)

You can also print the results to a file and create a cronjob for this.

EDIT:

Disable "sudo su" for simplifying the logging.

1. Use visudo for editing the sudoers file.
2. Add a line like this one: Cmnd_Alias  SUCMD = /bin/su
3. Be sure to use !SUCMD for the user or system privileges: %sudo ALL=(ALL) ALL,!SUCMD
share|improve this answer
    
thanks Abrahamsson! just like many other approaches, this wouldn't log everything after "sudo su".I've been at a loss yesterday; a google-search with few different keywords brought up this: serverfault.com/questions/201221/… stackoverflow.com/questions/15698590/… sourceforge.net/projects/rootsh –  jlsksr Jun 30 '13 at 15:01
    
Seems like the easiest way is to disable "sudo su" i will edit my post for that. –  Carl Abrahamsson Jun 30 '13 at 23:16
    
thanks for your mail! again, one could slip out of this, eg. by starting a shell in emacs or vi or whatever. i'll take a closer look on gnu acct, as nod suggested; think that would do the job. –  jlsksr Jul 1 '13 at 8:34

This is exactly what acct is designed for.

See:
man acct
http://www.gnu.org/software/acct/
http://www.cyberciti.biz/tips/howto-log-user-activity-using-process-accounting.html

share|improve this answer
    
thanks nod! i'll take a closer look at this.. –  jlsksr Jul 1 '13 at 8:35

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.