Hi dear friends
I have an RHEL5 installed and I gave all users on it rbash shell, Now I want to audit all commands that they did in there shell once they enter them, Can any guide me to the way
Thanks
One simple auditting is to make sure they have the history being recorded (in /etc/bash.bashrc or /etc/profile so the user cannot easily disable it) and as part of the bash logout script copy that history to somewhere for safe keeping.
bash does not have an auditing feature. If you are happly to build and deploy a custom version of bash, there are patches available on the web to add auditing facilities.