I have this user that has limited sudo privileges, yet he manages to screw up from time to time. I would like to keep an eye on his adventures, so that I can reverse any damage with less digging. Ideally, I'd want a service with the following functionality being well integrated and presentable
- Tracks shell input and output like
sudoif logging is set up) and can replay the session like ttyplay (or
sudoreplay) Compatibility with ncurses programs would be nice, but not necessary,
ttyreccan do it apparently.
- Tracks file access, creation and modification. Ideally, it could also backup a file each time it is changed or deleted.
So far I have found several tools that I would have to set up to get most of the requested functionality, but I haven't come across an OSS product that would integrate them nicely (Lynis community edition isn't really clear on the functionality).
- I could put
sudo -u $USER -i(with sudo logging set up) in his
.bashrcto log the shell IO.
- Set up auditing to track file access in some dirs, like
- Create a LVM snapshot when he logs in, but that is a bit of an overkill and might degrade system performance.
ttyrec seems to be a better alternative to
script, it would satisfy all my IO logging requirements. Now I need to find a good way to log file manipulation.
I'll be grateful for any suggestions or recommendations of best practices.