Re: critical server commands logging

[Stephen Satchell <list@fluent2.pyramid.net>]

At 09:42 AM 1/11/03 -0800, Prashant Desai wrote:
>   i want to log each and every commands which
>each user gives during  their login session to the
>redhat linux 7.1/6.1/7.0 servers these server are very
>critical for us and as there are multiple users around
>5 whom are using these server , ya all the logging
>should go to the syslog server ,
>
>     has any one done this ? how ?
>
>    is this  possible  ?? how ? any  pointers would be
>greatly appritiatted.

If the server is so critical, why are these five people doing *anything* on 
it?  Boxes are so cheap that it may be better for the five users to use a 
less critical server.  Disable remote shell access to the server (so in 
order to log on, someone has to use the console) and lock up the console.

Maintenance functions can be scripted, and then your scripts can use the 
logger(1) function to indicate who and what.  Scripts would also perform 
sanity checks on the changes to be made on the server, so that 
misconfiguration becomes less of a problem.

If you absolutely must allow shell access, you can take the source of bash 
and patch it to include calls to the syslog function to log command-line 
input.  Unless you are very, very careful, though, you will catch virtually 
all script-based activity built into the system, which makes for a very 
large log.  On the other hand, if you go too far in the other direction, 
people can create and execute scripts and you will never know what was in 
those scripts.

Better to compartmentalize.

Satch



-- 
The human mind treats a new idea the way the body treats a strange
protein:  it rejects it.  -- P. Medawar
This posting is for entertainment purposes only; it is not a legal opinion.