Re: [gentoo-server] Root commands > syslog

[Rev. Jeffrey Paul]

On Thu, Jun 17, 2004 at 09:47:25AM -0700, Jason Qualkenbush wrote:
>
> As far as logging commands once someone gets a root shell, I did find
> some info (if anyone is interested).  First, there was syscalltrack
> (http://syscalltrack.sourceforge.net/index.html) which seems to work,
> but looks to be more like a debugging tool.
>
> I did find a bash shell patch called bash-bofh that logs all commands to
> syslog.  Though, I the only pages I seem to find are hacker oriented
> pages and the homepage seems to raise backdoor questions
> (http://www.ccitt5.net).  Still, the bash-bofh is the closest to what I
> seek so far.

These methods, as well as the sudo one mentioned earlier in this thread, 
are all unreliable.

I assume most of you are already using the gentoo kernel or have 
grsecurity patched into whatever other kernel you're using on your 
servers; simply turn on exec and chdir logging.

Example: 
Jun 17 15:27:46 [kernel] grsec: exec of [03:03:207557] (tail current ) by 
(bash:12670) UID(0) EUID(0), parent (bash:30029) UID(0) EUID(0)

-j

--
--------------------------------------------------------
 Rev. Jeffrey Paul    -datavibe-     sneak@××××××××.net
   aim:x736e65616b   pgp:0x15FA257E   phone:[phone]
    70E0 B896 D5F3 8BF4 4BEE 2CCF EF2F BA28 15FA 257E
--------------------------------------------------------