I'm having an issue with keystoke logging. As we know in unix you can press tab to auto-complete a command or whatever it is you are typing. Well keystoke logging in
/var/log/ks
, tabs are actually showing up as tabs rather than whatever the auto-completion was.
Any ideas?
Whatever was autocompleted, if you run it, it will be in your history file.
Understood. But if you are a security administer you aren't going to look through every user history file plus it should show up in the ks file.
So what? The keystroke log contains the keystrokes that were entered; not how those keystrokes were evaluated by whatever application was reading those keystrokes.
As an administrator you are able to apply or even build the tools that will help you flip through the users' history files in an instant searching for whatever you might need...
If you're getting any security-related data from a USER-OWNED history file you're doing it wrong.
You want to know what commands a user runs? That's what auditing is for.