0

Please forgive the ambiguous nature of this question but I was wondering if there's a way to make sure that all commands executed by some host are logged into history. In my case, if I send a command across a network to a host and it gets executed. When I check the history there is no record of that command. Is this typical behavior/can I change it?

  • How exactly do you "send a command across a network to a host"? – celtschk Aug 24 '15 at 19:31
  • 1
    If by history you mean the shell history, that's not likely to work (not least because it's writeable by the user). Maybe auditd is interesting for you? – Ulrich Schwarz Aug 24 '15 at 19:33
3

The shell history is maintained for interactive shell sessions (and is trivial to alter or disable); assuming the remote command is done via SSH, the shell need not even be involved given that sshd can simply fork and exec the command to run. Solutions would include turning on process accounting (this is global to a system) or using some sort of wrapper for the (presumably) SSH connection that in addition to the fork and exec bit also writes a log of what is being run somewhere.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.