From owner-freebsd-security Fri Aug 28 15:12:17 1998 Return-Path: Received: (from majordom@localhost) by hub.freebsd.org (8.8.8/8.8.8) id PAA00579 for freebsd-security-outgoing; Fri, 28 Aug 1998 15:12:17 -0700 (PDT) (envelope-from owner-freebsd-security@FreeBSD.ORG) Received: from shell6.ba.best.com (shell6.ba.best.com [206.184.139.137]) by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id PAA00574 for ; Fri, 28 Aug 1998 15:12:15 -0700 (PDT) (envelope-from jkb@best.com) Received: from localhost (jkb@localhost) by shell6.ba.best.com (8.9.0/8.9.0/best.sh) with SMTP id PAA20209 for ; Fri, 28 Aug 1998 15:11:19 -0700 (PDT) X-Authentication-Warning: shell6.ba.best.com: jkb owned process doing -bs Date: Fri, 28 Aug 1998 15:11:19 -0700 (PDT) From: "Jan B. Koum " X-Sender: jkb@shell6.ba.best.com To: security@FreeBSD.ORG Subject: Re: Shell history (Was: Re: post breakin log) In-Reply-To: <199808280820.KAA00469@CoDe.hu> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org cat /dev/null > typescript -- Yan www.best.com/~jkb/ Unix users of the world unite: www.{free,open,net}bsd.org | www.linux.org | www.apache.org | www.perl.com "Turn up the lights, I don't want to go home in the dark." On Fri, 28 Aug 1998, Zahemszky Gabor wrote: >> >> This is assuming intruder will not try to change shell, turn off >> history within the shell and is in general pretty clueless when it comes >> to shell history. :) >> A friend of mine came up with an idea to create a shell which >> would log everything a user does.. not via shell history mechanism, but >> rather ala watch(8). Everything user types would go into some files >> somewhere. Then again, nothing ever came out of it. > >man script > >ZGabor at CoDe dot HU > >-- >#!/bin/ksh >Z='21N16I25C25E30, 40M30E33E25T15U!' ;IFS=' ABCDEFGHIJKLMNOPQRSTUVWXYZ ';set $Z ;for i { [[ $i = ? ]]&&print $i&&break;[[ $i = ??? ]]&&j=$i&&i=${i%?};typeset -i40 i=8#$i;print -n ${i#???};[[ "$j" = ??? ]]&&print -n "${j#??} "&&j=;typeset +i i;};IFS=' 0123456789 ';set $Z;X=;for i { [[ $i = , ]]&&i=2;[[ $i = ?? ]]||typeset -l i;X="$X $i";typeset +l i;};print "$X" > To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message