Re: [gentoo-user] logging my activity for audits

[Grant Taylor]

On 09/11/2018 06:51 AM, wiicontroller@×××××.com wrote:
> If by “all” activity, the customer means all activity, pam_tty_audit is
> the only solution I have heard of that fits the bill:
>
> https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/security_guide/sec-configuring_pam_for_auditing

I'm not familiar with pam_tty_audit, and I didn't see / find ssh in the 
linked page.  Does pam_tty_audit capture content from SSH sessions? 
What about ssh remote command execution?

I can conceptually see how it could if it hooks low enough into the tty 
layer.

> If by “all” activity, the customer means, “We want want a Serious
> Business Stamp,” I recommend getting creative with your shell's
> $HISTFILE, given that 98% of your activity occurs there.

I discourage this.

1)  Depending on how it's done, it can break history across sessions.
2)  The $HISTFILE is inherently user writable.  Which means that the 
user can modify it.
3)  The $HISTFILE is a convenience.
4)  The $HISTFILE is NOT an audit log.
5)  Depending on how the shell is configured, commands can bypass the 
$HISTFILE.
6)  The $HISTFILE does nothing for people putting commands in a script 
and then running the script.  —  I had someone do exactly this at my 
last job.

I *HIGHLY* recommend running as much as you can through sudo.  Sudo 
events do end up in syslog on every system I've used.



-- 
Grant. . . .
unix || die