From owner-freebsd-security@FreeBSD.ORG  Fri Jan 23 01:11:43 2004
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id A9C4816A4CE
	for <freebsd-security@freebsd.org>;
	Fri, 23 Jan 2004 01:11:43 -0800 (PST)
Received: from publicd.ub.mng.net (publicd.ub.mng.net [202.179.0.88])
	by mx1.FreeBSD.org (Postfix) with ESMTP id EFC2D43D49
	for <freebsd-security@freebsd.org>;
	Fri, 23 Jan 2004 01:11:37 -0800 (PST)
	(envelope-from ganbold@micom.mng.net)
Received: from [202.179.0.164] (helo=ganbold.micom.mng.net)
	by publicd.ub.mng.net with asmtp (Exim 4.30; FreeBSD)
	id 1AjxIV-000Nvb-Fr
	for freebsd-security@freebsd.org; Fri, 23 Jan 2004 17:08:15 +0800
Message-Id: <6.0.1.1.2.20040123170720.02a693d0@202.179.0.80>
X-Sender: ganbold@micom.mng.net@202.179.0.80
X-Mailer: QUALCOMM Windows Eudora Version 6.0.1.1
Date: Fri, 23 Jan 2004 17:15:37 +0800
To: freebsd-security@freebsd.org
From: Ganbold <ganbold@micom.mng.net>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"; format=flowed
Subject: keyboard activity logging in FreeBSD
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Security issues [members-only posting]
	<freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 23 Jan 2004 09:11:43 -0000

Hi,

I would like to log all keyboard activities in all ttys in my FreeBSD 5.2 box.
Is there anyway to do it? I read the watch man page and it seems like
I should run watch with tty as many times as number of ttys. Am I right?
Also is it possible to do the log in invisible way?
The main reason is to log all commands typed in shell and tty and send the 
log to the remote server.
How can I accomplish that?
Any helps and directions are greatly appreciated.

thanks in advance,

Ganbold