unix "script" command (Security)

UNIX for Advanced & Expert Users
1

Has anyone had the opportunity to set up a profile utilizing the "script" command to capture input?

I am utilizing solaris 8 on sun servers.

I modified the /etc/profile to start "script" when the user logs in and stops upon log out. It will also follow the user when it traverses across systems.

The issue I am having is supressing the message when script starts and stops. ( Script started, file is typescript, Script done, file is typescript)
I don't want the users to know it is running.

If this is a duplicate post to anyone, (I didn't see any in FAQ) my apologies in advance.

Any thoughts are appreciated.

Krusty.

2

:smiley: alread tried redirection of standard out to dev/null ?
>/dev/null

3

:smiley:
yepper....

I think because "script" gathers all of the info, the only way to get the comment stripped is to search the c code and recompile the binary. I am checking with my sun rep for the source.

Very interesting project though...

4

Did u get any solution for this?
Even I was trying to get this done somehow...

Regards
Deepa

5

You should be able to redirect std out and std err to null.

2> &1 /dev/null OR 2> /dev/null ... 1> /dev/null

I can't remember the syntax, but that is close.

:cool:

6

> /dev/null 2>&1

or

2>&1 > /dev/null

Has the effect of piping 2 (std error) to 1 (std out) and then piping 1 (now both) to /dev/null

7

I basically got the script.c binary and recompiled it to meet my needs.

The user will log into the system and never know that script is running.

Works great!

Thanks for all the replies.

-K

8

Krusty,

You will have a problem with this if your users use vi. It is not very compatible with the script command.

Commands like cat and more and vi will cause grief for you.

From the man page for script.

WARNINGS
A command such as cat scott, which displays the contents of the
destination file, should not be issued while executing script because
it would cause script to log the output of the cat command to itself
until all available disk space is filled. Other commands, such as
more(1), can cause the same problem but to a lesser degree.

  script records all received output in the file, including typing
  errors, backspaces, and cursor motions.  Note that it does not record
  typed characters; only echoed characters.  Thus passwords are not
  recorded in the file.  Responses other than simple echoes \(such as output from screen-oriented editors and ksh command editing\) are
  recorded as they appeared in the original session.

:cool: