Hi, is there a bullet proof of getting the history of all commands entered by a user on a specific server and idealy with the times ?
We have several servers. Therefore we can simply logon to one and do RLOGINS to go to others. We always first logon to servers with our personnal login and then switch to root. From there we can either work directly or switch to a few other users. We have the option of connecting to another server using RLOGIN (but with first being root as we don`t have to enter passwords on the rlogined server).
I have to find out if a specific employee did some work over the weekend as it is causing major escalation pain.
I am not sure if just doing a ROOT> HISTORY -999 is safe enough to check the activity of any users on one specific server no matter how they connected to it.
[added comments]
I just remembered that someone here once retrieved every single screen outputs that was done on one specific server including command prompt. Maybe that is what I need but don't recall how he did it.
We are using /bin/ksh shell by the way and AIX v4.2
I saw an interesting take on this problem once. Only Operations had the root password, and management approval was required to give it out. Admins gained root access by running a shell script (call it suroot) which called the script command to direct the screen activity to a temporary file, then called sudo to put the caller into root shell. When root was exited the script sent the screen output file to a remote security server. When root was entered and exited, an email was sent to the security server. This did not prevent the root user from removing or altering the temporary script file, so it was no proof against clever malice. But an audit that showed entry and exit without a screen file would have been flagged. But even that might have been hacked. The tool was more for a record of what was done, which was useful for honest admins to diagnose a goof-up.
In your case, this is closing the barn door. If you can't trust root, who can you trust?
I have plans to change this (in fact just about everything) and got the GO to do so.
But in the mean time, I need to get an answer to this problem as we had a problem on the last weekend and it got escaladed to the directors. I have to find out if an employee is telling me the truth on what he did or if he is lying to me (what I believe but the proofs are slim). He claims he did a task but when I look at the folders, I do not see this. I need to get a proof he did not do it and not that he had problems doing it or did it wrong.
So, the user could have edited the file as root? Or would he/she have done so as him/herself? My initial thought is that you could run a find on all files modified since last week...
find <directory> -mtime -7 -user <user>
if the employee knows what he is doing, you have no way to find out specific commands to a specific time
check the history file $HOME/.sh_history, if it has been deleted you can see if the employee is trying to hide something
if you delete a specific command from the .sh_history using vi, it's not possible to scroll back since the history file is a special file, check out for this
you can follow his IP-Adress using the "last" command from server to server and see where he was logged in, so you can say if he has been on this server or not
perhaps tell us what you expect he was doing, maybe there is another way
for the future, you can use sudosh, which shows the user input in realtime! you can play it like a movie, including backspace and so on, or put the following entries in /etc/profile, that is what we are doing:
export HISTFILE=/somedir/${LOGNAME}`date "+%Y%m%d%H%M%S"`
export HISTSIZE=2000000
the disadvantage of this is, that the user is able to delete this files