On Sun, Dec 16, 2012 at 06:38:08AM -0430, Andres Perera wrote:
| On Sun, Dec 16, 2012 at 5:47 AM, Paul de Weerd <[email protected]> wrote:
| > On Sun, Dec 16, 2012 at 11:02:31AM +0100, David Coppa wrote:
| > | > .profile can be interrupted with ctrl+c.
| > |
| > | >>> Because it is under controle or the user and he/she can disable
| > | >>> such funcionality.
| > |
| > | the safer way imho is patching ksh
| >
| > After that, expect all your users to suddenly switch to one of the
| > other shells available on your system...
|
| because once you patch ksh, you can't ever again edit /etc/shells
switching shells:
Step 1: login
Step 2: exec (zsh|csh|perl|tcsh|bash|...)
Step 3: ...
Step 4: profit
Sure, you can edit /etc/shells and prevent users from changing their
login shells with chsh, but what does that buy you if they can still
switch shells ?
And besides .. the users that want to run another shell in the first
place are screwed ? You'd have to patch 'em all .. good luck with
maintaining that.
Then, you could log all stdin/stdout to some file (even more data!
fun!). If you really want to circumvent this logging, you could
create a covert channel that will show data on the client side but has
no visible input/output in the server side.
I'm still curious why any of this is a good idea.
| > Or a nice syslog DoS, where people run while :; do echo ${RANDOM} >
| > /dev/null; done (or a less intentional version of the same) to flood
| > your logs with crap.
|
| and fsize becomes immutable as well apparently (syslog be forgotten)
Not sure I understand your point here. What about fsize ? You want
to limit the size of the logfile ? So that all you have to do is fill
it up to the max size and then you can do whatever you want without
having your actions logged ?
| here is something that doesn't require patching
|
| create log files and change to system append-only with chflags. dir
| should be, e.g., chown root:wheel, chmod go=rx
|
| #include <sys/types.h>
| #include <stdio.h>
| #include <unistd.h>
| #define sp "/usr/bin/script"
| #define sf "/var/db/ghetto_act/%ju"
|
| main()
| {
| char *so;
| if (asprintf(&so, sf, getuid()) == -1) return 1/0;
| execl(sp, sp, "-a", so, NULL);
| return 1/0;
| }
|
| >
| > Why is this a good idea, exactly ?
| >
| > Paul 'WEiRD' de Weerd
| >
| > --
| >>++++++++[<++++++++++>-]<+++++++.>+++[<------>-]<.>+++[<+
| > +++++++++++>-]<.>++[<------------>-]<+.--------------.[-]
|
| o look, a brainfuck program. this is so quirky and tech oriented i
| feel identified with you
Great, glad you like it.
Paul 'WEiRD' de Weerd
--
>++++++++[<++++++++++>-]<+++++++.>+++[<------>-]<.>+++[<+
+++++++++++>-]<.>++[<------------>-]<+.--------------.[-]
http://www.weirdnet.nl/
