We'd like to keep track of user activity on one of our Centos7 machine. To do so, management decided to use script and scriptreplay to basically records user activity and replays it. I did some research on my side on how we should design it, but solutions relying on auditd are rejected here by management, and putting the script in the .profile of the user leads to some issues as explained below.
The expected behavior is as follow:
- When a user logs to the server via SSH, the script command spawns and starts logging user activity to a file.
- When the user is done on the server, he logs off (usually types exit or CTRLD).
- script process stops and close the file.
Now the issues:
My researches showed me that script actually creates another shell. So if I put - let say - script script.log in the .bash_profile of every users (or in skel), it will issue a new shell for the user after login, and the user can easily abort the process and start typing commands in his usual SSH session. How can I force my script to actually kicks the user off when he exits the shell spawned by the script command ?
The script output (ie. users' commands) should be stored in a private place where non-sudoers cannot do anything (no R/W/E permissions). How can we run scripts with elevated privilege on user login when the user is himself non-priviledged ?