-2

I am a non-root user in a linux server.

I want to copy some file in this server.

but i dont want anyone to tracked this operation.

Can you offer some suggestion?

3
  • Why do you think you'd be tracked? Is there auditing enabled in this machine or use it otherwise considered especially sensitive data? – roaima Apr 10 at 11:48
  • If auditd tracks reads from this file or directory, there's no way aside from hacking the server. – Artem S. Tashkinov Apr 10 at 12:08
  • Welcome to Unix.SE! @nick I assume you mean "not being tracked" as in security? (or similar) I would (without, any context - I am guessing) it would get you closer to what you're after, is probably to use either Encryption (some sort of) /or obfuscation, and/or - the unset histfile in the terminal, and(again) removing the specific lines/... of the bash_history file? It really depends on who is tracking you - (some background info would really be helpful) Like for example, how would you like it to be copied? from and to the server - or from server to you? (...) :) – William Martens Apr 10 at 17:08
2

Short answer: either the normal way (except for bypassing the command history, if applicable), or not at all.

By default, nothing logs file accesses as such. So as soon as you've finished copying the file, there is no record left of your copy.

However, the command you used to copy the file may itself be logged. For example, if you used cp or a similar command from a command line shell, your command is logged into the shell's history file. You can start a shell with history disabled, or edit the history afterwards to remove the command (which can be a little tricky if there's a running shell that still remembers the command and saves it again). If you used FTP or a similar service, it may log every command you issue, and there's likely no way for you to access the log.

It's not clear whether you're copying the file to or from that server or both. If you're creating a file, the fact that you created it, as well as when you created it, are both recorded: you'll be the owner of the file, and the file's modification time (mtime) indicates when you last modified it (creation counts as a modification of course). You can change the mtime. The file's inode change time indicates when you last changed the file's metadata (including the mtime) and you can't change it. You cannot change the owner.

If you're reading a file, the owner of that file can know when someone is reading it, but not who (through inotify).

The administrator can set up additional logging (for example through audit). There is no way to know whether they did so, and no way to bypass it.

Not the answer you're looking for? Browse other questions tagged or ask your own question.