0

At the user level is there a way for me to craft a sort of 'tripwire' in my .bashrc file to detect if another user has sourced my .bashrc?

What I would like to do is have some sort of log created that will detect anytime somebody sources my .bashrc file with the username that sourced it.

Ideally, the log information should be pushed to a remote server that I have complete control over to prevent tampering.

  • 3
    Welcome to Unix & Linux at StackExchange, @Ellicia! Regarding your question... It's hard to say what such a mechanism would actually prevent... If other users can source your .bashrc, they can just as well copy them somewhere, remove the commands that do the logging and just source the rest of it instead... What is it exactly that you're trying to accomplish? Have you considered making your .bashrc (or parts of it) readable by only your user, with a command such as chmod 600 .bashrc? – filbranden Jan 5 at 7:55
  • If you mean by putting commands into the file, sure; but they would be visible to anybody who looked at the file first.  If you mean without putting commands in the file, say so. – G-Man Jan 5 at 7:56
  • A command like echo user=$USER:pid=$$:time=$(date -u +'%s') | logger -p local0.notice -t USEDBASHRC could allow you to log such use to the logging system, which could (should?) be running in a remote system to avoid tampering with the log system. As long as you could trust that the commands will be executed and that the values of the variables are correct. – Isaac Jan 5 at 8:36
  • @Isaac Thank you. Something like this is what I was looking for. I expanded a bit on it to run a UID check to see if it was my user and if not then send it to the logs. – Ellicia Feb 9 at 23:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.