track employees browsing activity [closed]

Question

I am working as IT admin. I want to keep track of all employees system activity, like which sites they are using etc. Basically, I want to checkout if anybody is doing outside or freelancing work in office hours. Is there any tool to check every users activity? Every employee uses Ubuntu system. As there are many tools for windows but didn't find any for Linux.

Answer 1

You should set up a proxy server. I myself have used squid as a proxy server and I consider it a reliable and stable solution.

Once you set up the server, you need to block all outgoing traffic to ports 80 and 443, except the address of the server. Then, you need to automate the configuration of the proxy server to the end user workstations - it won't be convenient I think to ask them to configure it by themselves.

And also need to consider a user friend front-end for the squid server, so that you could easily review browsing statistics (e.g. lightsquid).

Answer 2

I agree with @13nilux to some extent - however a lot of browsing is now done using https - so unless you are willing to compromise the chain of trust, a proxy server won't work. (I also note that you can do transparent proxying and thus don't need to worry about automating configuration of the workstations).

If you are just trying to get a feel for what is happening, you could (instead, or in addition) require all DNS traffic (port 53) to be routed through your recursive nameservers and log the requests. This will tell you what sites are being visited, but not what pages. By tying the requesting IP addresses to the DNS queries you can build up a fair model of whats going on.

Another partial solution - which does not require monitoring - would be to look at their browser histories. Have a look here for more info, but basically its a matter of querying the .sqlite databases used by Mozilla. The answer from Pawomoy (currently the last one) is, in effect, a cut and paste script which will list the URL's visited today. If you maintain central authentication you should be able to use SSH to log onto each system and programmatically retrieve this data.