This looks like a nifty solution. http://blog.rootshell.be/2009/02/28/bash-history-to-syslog/
On Tue, Jan 19, 2010 at 7:46 AM, Dave Ockwell-Jenner <[email protected]>wrote: > Monkey Daemon wrote: > > Hi, > > > > I've just discovered a system on which one of our darling users has > > decided adding a script to his .bash_logout file that removes > > .bash_history on logout is a clever thing to do. > > > > Is there a way to take a copy of the .bash_history file before it is > > deleted? This user obviously has something to hide as far as I'm > > concerned, so I need to archive this file to present it as evidence. > > > How about compiling a custom version of bash that writes the history > file out to an alternate location? I have used that technique in the > past for a similar situation and it was quite effective. There is little > chance someone would suspect a 'trojaned' shell, typically. > > Cheers, > Dave. > _______________________________________________ > Pauldotcom mailing list > [email protected] > http://mail.pauldotcom.com/cgi-bin/mailman/listinfo/pauldotcom > Main Web Site: http://pauldotcom.com >
_______________________________________________ Pauldotcom mailing list [email protected] http://mail.pauldotcom.com/cgi-bin/mailman/listinfo/pauldotcom Main Web Site: http://pauldotcom.com
