Re: [gentoo-server] Root commands > syslog

[Joey Abaya Panoy]

>I agree, the GRSec Kernel Auditing features work quite well and are just
>informative enough to give you the info you're looking for... :)
>
>
>
>>On Thu, Jun 17, 2004 at 09:47:25AM -0700, Jason Qualkenbush wrote:
>>
>>
>>>As far as logging commands once someone gets a root shell, I did find
>>>some info (if anyone is interested).  First, there was syscalltrack
>>>(http://syscalltrack.sourceforge.net/index.html) which seems to work,
>>>but looks to be more like a debugging tool.
>>>
>>>I did find a bash shell patch called bash-bofh that logs all commands to
>>>syslog.  Though, I the only pages I seem to find are hacker oriented
>>>pages and the homepage seems to raise backdoor questions
>>>(http://www.ccitt5.net).  Still, the bash-bofh is the closest to what I
>>>seek so far.
>>>
>>>
>>These methods, as well as the sudo one mentioned earlier in this thread,
>>are all unreliable.
>>
>>I assume most of you are already using the gentoo kernel or have
>>grsecurity patched into whatever other kernel you're using on your
>>servers; simply turn on exec and chdir logging.
>>
>>Example:
>>Jun 17 15:27:46 [kernel] grsec: exec of [03:03:207557] (tail current ) by
>>(bash:12670) UID(0) EUID(0), parent (bash:30029) UID(0) EUID(0)
>>
>>
>>
You may find this bash patch [bash-perassi.patch 
<http://honeynet.org/tools/>] useful from http://honeynet.org/tools/
Supports logging of keystrokes via UDP over the network.

But what if he switch to other shell like sash?

There is also a tool there called sebek 
http://honeynet.org/tools/sebek/faq.html that can
capture all user activities. But i think this is an overkill for your 
intended purpose.


<http://honeynet.org/tools/dcapture/bash-perassi.patch>