Date: Thu, 27 Aug 1998 23:23:53 -0400 From: "Joe Gleason" <clash@tasam.com> To: "Wilson MacGyver" <macgyver@cylatech.com>, <security@FreeBSD.ORG>, "Brian Behlendorf" <brian@hyperreal.org> Subject: Re: post breakin log Message-ID: <00bb01bdd233$76594990$f10408d1@bug.tasam.com>
next in thread | raw e-mail | index | archive | help
You could always make a custom bash that sends each command to syslog as it is done. ;-) Then you could have your syslog log it to a remote system. Joe Gleason Tasam >At 01:38 AM 8/27/98 -0400, Wilson MacGyver wrote: >>the log from history follows. > >Is there a fool-proof way to get user histories like this? I got one once >only because the cracker was lame enough to forget to delete his >.bash_history file. Presuming root isn't compromised of course... > > Brian > > >--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-- >"Common sense is the collection of prejudices | brian@apache.org >acquired by the age of eighteen." - Einstein | brian@hyperreal.org > >To Unsubscribe: send mail to majordomo@FreeBSD.org >with "unsubscribe freebsd-security" in the body of the message > To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?00bb01bdd233$76594990$f10408d1>