Re: [gentoo-server] Root commands > syslog

[Joey McCoy]

I agree, the GRSec Kernel Auditing features work quite well and are just
informative enough to give you the info you're looking for... :)

> On Thu, Jun 17, 2004 at 09:47:25AM -0700, Jason Qualkenbush wrote:
>>
>> As far as logging commands once someone gets a root shell, I did find
>> some info (if anyone is interested).  First, there was syscalltrack
>> (http://syscalltrack.sourceforge.net/index.html) which seems to work,
>> but looks to be more like a debugging tool.
>>
>> I did find a bash shell patch called bash-bofh that logs all commands to
>> syslog.  Though, I the only pages I seem to find are hacker oriented
>> pages and the homepage seems to raise backdoor questions
>> (http://www.ccitt5.net).  Still, the bash-bofh is the closest to what I
>> seek so far.
>
> These methods, as well as the sudo one mentioned earlier in this thread,
> are all unreliable.
>
> I assume most of you are already using the gentoo kernel or have
> grsecurity patched into whatever other kernel you're using on your
> servers; simply turn on exec and chdir logging.
>
> Example:
> Jun 17 15:27:46 [kernel] grsec: exec of [03:03:207557] (tail current ) by
> (bash:12670) UID(0) EUID(0), parent (bash:30029) UID(0) EUID(0)
>
> -j
>
> --
> --------------------------------------------------------
>  Rev. Jeffrey Paul    -datavibe-     sneak@××××××××.net
>    aim:x736e65616b   pgp:0x15FA257E   phone:[phone]
>     70E0 B896 D5F3 8BF4 4BEE 2CCF EF2F BA28 15FA 257E
> --------------------------------------------------------
>


--