0

I am trying to create a daemon to monitor a users's bash_history file for manual modifications. In other words, if a user opens the file and modifies it, the daemon will notify this action for safety measures, but when the history updates itself, nothing happens.

The solution I tried is using inotifywait:

while true; do
    inotifywait -e close_write,move,delete ~/.bash_history && notify
done

where notify is a script that will do a specific notification procedure.

I believe this would work fine for most of files, but in this case it doesn't, since notify is executed every time the history updates.

Is it possible this way, or should I use another application?

| improve this question | | | | |
  • I doubt this will be possible. How could the system know whether a user or an automated process opened the file? In both cases, the file was opened. – terdon May 10 '16 at 14:08
  • I'm not familiar with System Tap, but could it or something similar be used to check what process opened the file? As an aside, you may like to check out this link about trying to prevent users from editing their history files – forquare May 10 '16 at 14:13
1

That is not possible with inotify. There is no configuration that could probe if a file is altered by an user or a process, neither if it will monitor only "append to files".

And EVEN if there exists one "append to file" inotify event, one user could inject bash_history data with echo >> creating bogus entries and losing all the meaning of your monitoring.

You could harden your history files by following this advice, and i think this is the best you could do:

| improve this answer | | | | |
  • I see. In addition, I believe it's possible to instead of monitoring the history specifically, it would be better to watch whenever root logs in or sudo is used for superuser privileges. And if the bash history is secured, it could be possible to retrieve which commands were used. – dellief May 10 '16 at 22:22
  • Or, make bash use syslog and replicate the logs to a remote server. This could be more useful than creating local locks to local bash_history files – user34720 May 10 '16 at 23:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.