From owner-freebsd-questions Fri Feb 27 05:41:10 1998 Return-Path: Received: (from majordom@localhost) by hub.freebsd.org (8.8.8/8.8.8) id FAA20965 for freebsd-questions-outgoing; Fri, 27 Feb 1998 05:41:10 -0800 (PST) (envelope-from owner-freebsd-questions@FreeBSD.ORG) Received: from baste.magibox.net (root@baste.magibox.net [206.26.142.2]) by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id FAA20878 for ; Fri, 27 Feb 1998 05:40:59 -0800 (PST) (envelope-from mhorton@magibox.net) Received: from mhorton.aod.fedex.com by baste.magibox.net with SMTP (8.8.7/1.2-eef) id NAA14357; Fri, 27 Feb 1998 13:40:35 GMT Message-Id: X-Sender: mhorton@206.26.142.2 X-Mailer: QUALCOMM Windows Eudora Pro Version 4.0 Demo Date: Fri, 27 Feb 1998 07:37:35 -0600 To: pdinesh@opentech.stpn.soft.net From: Michael Horton Subject: Re: Logging User's activity Cc: "freebsd-questions@FreeBSD.ORG" In-Reply-To: <34F6DAEC.8DEED7F8@opentech.stpn.soft.net> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG Dinesh Pal, Couldn't you just "turn-on" the user's history function in her ".profile/.login/etc." file. This also provides for reusing previous commands. (Reusing commands is a great tool for every user. My history is set to 2500 and it is invaluable.) The history file can be evaluated (and the user's actions recreated). An added bonus is that if the file is removed or emptied of its contents, you have an indication that the user may want to conceal what she is doing and that you may have a problem in the making. The history file is a normal part of the UNIX user accounts that I have worked with and should not cause any concern on the user's part. You will probably find that that this user is trying to learn and is not a real or deliberate threat. If you ever wanted to do a security audit, now is a good time; the user can help you! MH At 2/27/98 09:25 AM , Dinesh Pal wrote: >One of my FreeBSd user is very creative .He always try to explore something new >on my servers .I want to log his all the commands entered by him without his >knowledge,So that i can check that later.Please advice. > >Thanks > > > > >To Unsubscribe: send mail to majordomo@FreeBSD.org >with "unsubscribe freebsd-questions" in the body of the message > To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message