Results 1 to 4 of 4
  1. #1
    Join Date
    Dec 2004
    Posts
    75

    question about .bash_history

    hy there.
    Is there any way to modify /etc/profile in one way like any user with shell to not modify HISTFILESIZE ?
    I meen let say that one user set in bashprofile HISTFILESIZE=0 and after that I can't see none of command that he run. Is there any posibility to log what he type ? He only log from ssh port not from the local machine.

  2. #2
    Join Date
    Dec 2004
    Posts
    75
    find it.
    Ii have to put readonly in /etc/profiles

  3. #3
    Join Date
    Jan 2005
    Location
    Chicago
    Posts
    226
    Just for fun, logging in non-interactive or to a different shell will defeat this.
    Ken

    CROWHOST hosting+colocation services | 877-CROWHOST | support at crowhost.com
    Independent remote-hands serving all Chicago data centers

  4. #4
    Join Date
    Apr 2004
    Location
    San Jose
    Posts
    902
    Relying on the bash history is error prone at best, if you have someone on your system you don't trust.

    You want to turn on user/process accounting and use lastcomm, which is not manipulable by the user, unless they have root privileges.

    http://www.linuxselfhelp.com/gnu/acc...ounting_5.html

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •