0

I am looking at hiring a company to help me setup some GSM Modem equipment on a Linux machine. They are going to SSH in and I was wondering if I can log all their commands not just in .bash_history but everywhere so I can duplicate the setup in the futures. The issue for example is if they run an installation file that prompts them for configuration details, the .bash_history wouldn't record that.

I saw a really ugly "keylogger" using strace, but looking for something with an output more similar to .bash_history, just more complete.

Improve this question
2
  • 1
    If you hire them, have the contract stipulates that the deliverables include a documentation that allow you to redo it later. Having a trace won't tell you why they do things anyway and will leave you helpless on the first deviation. You are also assuming that they won't prepare configuration files on their own machines. – xenoid Oct 19 '17 at 8:07
  • Thanks, that is a great point on the configuration files. I figured I could also search for all files by created / modified time if needed. It is an open source project they are configuring for me, but the part they are configuring is new and undocumented. – Alan Oct 19 '17 at 14:55
2

You could replace the user's login shell with your wrapper that runs the original shell, but saves its input and output somewhere. However, this will be ugly because it will likely include control characters, backspaces and so on.

However, I suspect you have other reasons for it - either lack of trust or you want to learn how to do it yourself. In this case, you should use a contract, not a keylogger. For example, you can ask the company to give you a shell script that you can run for yourself, or a documentation.

Improve this answer
1

Take a gander at the script utility. It "makes a typescript of everything printed on your terminal."

You can begin to record a session with: script record_me.log and then end the recording with:
exit. To review the session, you can cat the log file with: cat recordme.log, e.g.

Improve this answer
2
  • Awesome idea, I can include that in the .bash_rc to execute on login automatically. – Alan Oct 19 '17 at 14:56
  • 1
    Great. If you are satisfied with the answer, please mark it as correct. FYI, here's a thread on [how to clear the output so that it's readable:] (superuser.com/questions/236930/…). – marshki Oct 19 '17 at 17:10
0

I tried using the script utility and had some trouble with it producing repeating output and starting a ton of sessions, which incidentally if you do try that and end up with 20+ sessions running, you can kill them all using this:

ps -ef | grep script | grep -v grep | awk '{print $2}' | xargs kill -9

This solution (http://archive.is/eSTid#selection-391.5-391.36) would probably do better if I used RSA keys to login, but since I don't, in the end I used this other project, which when configured gave me the best output.

https://github.com/open-ch/log-user-session

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.