Logging shell commands and send it out

Applications Cybersecurity
1

Dear friends
I'm looking for a solution to log all commands that users do in my RedHat box, and send it out to other remote server,
Is there any guide for that
Thanks

---------- Post updated at 04:20 AM ---------- Previous update was at 03:47 AM ----------

I can think of something else
I already have a sloution to logg all commands but in the same local machine
and have have a syslog server,
Now how I can make syslog logs this file that have commands logs?

2

Run something like:

cat userlogfile | logger -p auth.notice

as the user logs out?

3

Nice Idea
But this will make this once , I want to make the userlogfile always under monitoring, Which means that any updates happened on it logged by syslog once it happened.

Thanks

4

Have a look at 'rootsh'.

Rootsh can log to syslog so the only thing you need to do is make the remote syslog server also listen for external syslog messages and configure your local syslog server to send messages to remote.

5

ksh93 supports this feature by default using the audit/accounting facility. See KSH93 Auditing and Accounting for more information.

bash does not have any facilities to do this but if you search the Internet you will find patches out there which enable you to build a custom version of bash to provide this feature.

6

That's all nice but that patched Ksh does not hook into Syslog (wrt an implications of an application being allowed to do housekeeping on its own auditing, corellation benefits of centralized timestamping, remote logging opportunity) like 'rootsh' or 'sudosh' could. In that respect it is more akin to the Honeypot Bash patches Anotatla provided at the time. Also the article does not show any output is recorded like aforementioned applications could.

7

Unspawn said

First it is not a patched ksh93. No patches are required.

Second, you obviously did not read the post. Towards the end it provides a detailed example of how to do exactly what you are claiming it cannot do.

8

Apparently it can do remote TCP or UDP, I must have read over that. But with syslogging I mean using a facility/prio combo as in 'man 3 syslog' like the others do. I suppose I should have been more specific there.