Linux user logging

Linux user logging

[Michael Gale]

Hello,

	I know this is not a netfilter question but I was wondering if any one knows of a way to log all user activity. So if a
user logs in via a SSH connection I would like to log all user activity. What files the view or alter and any other
commands ?


-- 
Michael Gale
Network Administrator
Utilitran Corporation

Re: [OT] Linux user logging

[Antony Stone]

On Thursday 15 July 2004 10:14 pm, Michael Gale wrote:

> Hello,
>
> 	I know this is not a netfilter question but I was wondering if any one
> knows of a way to log all user activity. So if a user logs in via a SSH
> connection I would like to log all user activity. What files the view or
> alter and any other commands ?

Try a rootkit :)

If an attacker can implant a keystroke logger in your system, you should be 
able to too :)

Other than that - it's the beauty of Open Source Software - you can change the 
SSH daemon to do whatever you want it to, on your system....

Regards,

Antony.

-- 
"It would appear we have reached the limits of what it is possible to achieve 
with computer technology, although one should be careful with such 
statements; they tend to sound pretty silly in five years."

 - John von Neumann (1949)

                                                     Please reply to the list;
                                                           please don't CC me.

Re: Linux user logging

[Predrag Petrovic]

Well you have the .bash_history file :-/
LogWatch and lots of programs for those stuff :)
Michael Gale wrote:

>Hello,
>
>	I know this is not a netfilter question but I was wondering if any one knows of a way to log all user activity. So if a
>user logs in via a SSH connection I would like to log all user activity. What files the view or alter and any other
>commands ?
>
>
>  
>

Re: [OT] Linux user logging

[Aleksandar Milivojevic]

Michael Gale wrote:
> Hello,
> 
> 	I know this is not a netfilter question but I was wondering if any one knows of a way to log all user activity. So if a
> user logs in via a SSH connection I would like to log all user activity. What files the view or alter and any other
> commands ?

Yup, completely OT for this mailing list...

What you are looking for is called auditing.  There are some projects 
for implementing it on Linux, but AFAIK nothing final and stable.  If I 
understood it correctly (and I might be completely wrong here), the 
major problem is that core group of Linux kernel developers is reluctant 
in putting appropriate auditing hooks into kernel (not even as an 
compile time option for those that need it), for whatever reason.

Note that good auditing is not trivial to configure, and depending on 
what you want to log, auditing can produce *huge* log files.

-- 
Aleksandar Milivojevic <amilivojevic@pbl.ca>    Pollard Banknote Limited
Systems Administrator                           1499 Buffalo Place
Tel: (204) 474-2323 ext 276                     Winnipeg, MB  R3T 1L7

Re: [OT] Linux user logging

[Erik Wikström]

On Fri, Jul 16, 2004 at 09:49:13AM -0500, Aleksandar Milivojevic wrote:

> Michael Gale wrote:
> >Hello,
> >
> >	I know this is not a netfilter question but I was wondering if any 
> >	one knows of a way to log all user activity. So if a
> >user logs in via a SSH connection I would like to log all user activity. 
> >What files the view or alter and any other
> >commands ?
> 
> Yup, completely OT for this mailing list...
> 
> What you are looking for is called auditing.  There are some projects 
> for implementing it on Linux, but AFAIK nothing final and stable.  If I 
> understood it correctly (and I might be completely wrong here), the 
> major problem is that core group of Linux kernel developers is reluctant 
> in putting appropriate auditing hooks into kernel (not even as an 
> compile time option for those that need it), for whatever reason.
> 
> Note that good auditing is not trivial to configure, and depending on 
> what you want to log, auditing can produce *huge* log files.

You might be interested in looking at BSD Process Accounting, which can
be found under General Setup in the kernel configuration. It should give
you information about which processed a user run and such things.

I also have a option called Enable Auditing (also under General Setup)
in my 2.6.7 kernel. Both of these probably need some userland tools but
I'm sure a search can give you what you need.

--
Erik Wikström