Re: [gentoo-user] logging my activity for audits

[J. Roeleveld]

On Tuesday, September 11, 2018 5:24:47 PM CEST Grant Taylor wrote:
> On 09/11/2018 06:51 AM, wiicontroller@×××××.com wrote:
> > If by “all” activity, the customer means all activity, pam_tty_audit is
> > the only solution I have heard of that fits the bill:
> >
> > https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/h
> > tml/security_guide/sec-configuring_pam_for_auditing
> I'm not familiar with pam_tty_audit, and I didn't see / find ssh in the
> linked page.  Does pam_tty_audit capture content from SSH sessions?
> What about ssh remote command execution?

SSH can (it does by default) use PAM for authentication. I would suspect it 
only logs access and not actions.

> I can conceptually see how it could if it hooks low enough into the tty
> layer.

Xen logs all output of the VM to a text file if it is started automatically. 
This is done by attaching it to a screen-session and having screen log it all 
to a text file.
If there is a reliable method to force SSH-sessions into something like this, 
you can log all input and output.

> > If by “all” activity, the customer means, “We want want a Serious
> > Business Stamp,” I recommend getting creative with your shell's
> > $HISTFILE, given that 98% of your activity occurs there.
>
> I discourage this.
>
> 1)  Depending on how it's done, it can break history across sessions.
> 2)  The $HISTFILE is inherently user writable.  Which means that the
> user can modify it.
> 3)  The $HISTFILE is a convenience.
> 4)  The $HISTFILE is NOT an audit log.
> 5)  Depending on how the shell is configured, commands can bypass the
> $HISTFILE.
> 6)  The $HISTFILE does nothing for people putting commands in a script
> and then running the script.  —  I had someone do exactly this at my
> last job.

7) When using multiple sessions to the same account, the last session being 
closed determines the content of $HISTFILE.

> I *HIGHLY* recommend running as much as you can through sudo.  Sudo
> events do end up in syslog on every system I've used.

Does sudo have a shell-mode?

--
Joost