Logging shell sessions encrypted?

Question

I log all my shell activity using script, but am worried that there are quite a few passwords and other secret stuff in these log files.

Does anybody know of any way of logging the shell sessions in an encrypted manner? Are there maybe some similar utilities to script that integrates with GPG?

Answer 1

You could put the logfiles in an encrypted vault instead of encrypting individual files.

Or maybe let script write to a fifo, read that fifo with gpg and let gpg do the encryption and write it to a file.

Answer 2

If you are using bash, you could use your ~/.bash_logout script to encrypt the script logfile with gpg or something.

.bash_logout will need to know what the log's filename is. For example, instead of just running script filename, run a myscript function defined in your .bashrc.

function myscript() {

  # Very primitive option handling. This really needs to pass any script
  # command-line options on to script.
  # Left as an exercise for the reader and the getopts documentation :)
  if [ -n "$1" ] ; then
    SCRIPT_FILENAME="$1"
  else
    SCRIPT_FILENAME="$USER-$(tty)-$(date +%s)"
  fi
  readonly SCRIPT_FILENAME
  export SCRIPT_FILENAME

  script "$SCRIPT_FILENAME"
}

And then in the .bash_logout file:

  if [ -n "$SCRIPT_FILENAME" ] && [ -e "$SCRIPT_FILENAME" ] ; then
      gpg --batch --yes  -r 'YOUR-EMAIL-OR-ID' -e "$SCRIPT_FILENAME"
      shred "$SCRIPT_FILENAME" # or any other file secure-erase tool.
      rm -f ""$SCRIPT_FILENAME"
  fi

SECURITY WARNING: This makes your system vulnerable to anything (e.g. a sourced script) that can set the SCRIPT_FILENAME variable in your shell's environment. An attacker could set it to any file your userid has write access to. (Of course, an attacker could just overwrite that file themselves if they can run anything as you)

You could avoid this by setting $SCRIPT_FILENAME and making it readonly in your ~/.bashrc rather than in the myscript function. This would make it impossible to use a different filename with the myscript function.

Or you could store all your typescripts in one directory (e.g. /home/username/typescripts/). Then the .bash_logout script could check that:

• the filename begins with an absolute path to that dir,
• the filename does not end with .gpg
• there are no ../s in the filename
• the filename is not a symlink
• the filename's inode count = 1
• etc

before encrypting, shredding, and deleting it.

ANOTHER SECURITY WARNING:

BEWARE. DO NOT USE CODE EXAMPLES EVEN AT OWN RISK. MINE EXAMPLES FOR IDEAS ONLY.

While small parts of this have been tested individually, it has not been tested as a complete, functioning system. This answer is NOT intended to provide a complete solution. It is intended to provide ideas for you to explore and implement yourself.