From owner-freebsd-security Fri Aug 28 01:35:53 1998 Return-Path: Received: (from majordom@localhost) by hub.freebsd.org (8.8.8/8.8.8) id BAA17585 for freebsd-security-outgoing; Fri, 28 Aug 1998 01:35:53 -0700 (PDT) (envelope-from owner-freebsd-security@FreeBSD.ORG) Received: from mail.euroweb.hu (mail.euroweb.hu [193.226.220.4]) by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id BAA17562 for ; Fri, 28 Aug 1998 01:35:45 -0700 (PDT) (envelope-from hu006co@mail.euroweb.hu) Received: (from hu006co@localhost) by mail.euroweb.hu (8.8.5/8.8.5) id KAA18560; Fri, 28 Aug 1998 10:34:51 +0200 (MET DST) Received: (from zgabor@localhost) by CoDe.hu (8.8.8/8.8.8) id KAA00469; Fri, 28 Aug 1998 10:20:51 +0200 (CEST) (envelope-from zgabor) From: Zahemszky Gabor Message-Id: <199808280820.KAA00469@CoDe.hu> Subject: Re: Shell history (Was: Re: post breakin log) In-Reply-To: from "Jan B. Koum" at "Aug 27, 98 09:55:59 pm" To: freebsd.org!freebsd-security@zg.CoDe.hu Date: Fri, 28 Aug 1998 10:20:51 +0200 (CEST) Cc: best.com!jkb@zg.CoDe.hu X-Mailer: ELM [version 2.4ME+ PL38 (25)] MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org > > This is assuming intruder will not try to change shell, turn off > history within the shell and is in general pretty clueless when it comes > to shell history. :) > A friend of mine came up with an idea to create a shell which > would log everything a user does.. not via shell history mechanism, but > rather ala watch(8). Everything user types would go into some files > somewhere. Then again, nothing ever came out of it. man script ZGabor at CoDe dot HU -- #!/bin/ksh Z='21N16I25C25E30, 40M30E33E25T15U!' ;IFS=' ABCDEFGHIJKLMNOPQRSTUVWXYZ ';set $Z ;for i { [[ $i = ? ]]&&print $i&&break;[[ $i = ??? ]]&&j=$i&&i=${i%?};typeset -i40 i=8#$i;print -n ${i#???};[[ "$j" = ??? ]]&&print -n "${j#??} "&&j=;typeset +i i;};IFS=' 0123456789 ';set $Z;X=;for i { [[ $i = , ]]&&i=2;[[ $i = ?? ]]||typeset -l i;X="$X $i";typeset +l i;};print "$X" To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message