From owner-freebsd-security Fri Aug 28 14:05:15 1998 Return-Path: Received: (from majordom@localhost) by hub.freebsd.org (8.8.8/8.8.8) id OAA21232 for freebsd-security-outgoing; Fri, 28 Aug 1998 14:05:15 -0700 (PDT) (envelope-from owner-freebsd-security@FreeBSD.ORG) Received: from Mercury.unix.acs.cc.unt.edu (mercury.acs.unt.edu [129.120.220.1]) by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id OAA21225 for ; Fri, 28 Aug 1998 14:05:10 -0700 (PDT) (envelope-from john@unt.edu) Received: from leonardo.cascss.unt.edu (leonardo.cascss.unt.edu [129.120.32.203]) by Mercury.unix.acs.cc.unt.edu (8.8.8/8.8.8) with ESMTP id QAA11751; Fri, 28 Aug 1998 16:04:10 -0500 (CDT) Received: (from john@localhost) by leonardo.cascss.unt.edu (8.8.8/8.6.9) id QAA19029; Fri, 28 Aug 1998 16:01:28 -0500 (CDT) From: john Message-Id: <199808282101.QAA19029@leonardo.cascss.unt.edu> Subject: Re: Shell history (Was: Re: post breakin log) In-Reply-To: <35E6F857.1E8A4101@ameritech.net> from Adam McDougall at "Aug 28, 98 02:35:03 pm" To: mcdougall@ameritech.net (Adam McDougall) Date: Fri, 28 Aug 1998 16:01:28 -0500 (CDT) Cc: freebsd-security@FreeBSD.ORG X-Mailer: ELM [version 2.4ME+ PL32 (25)] MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org > Jan B. Koum wrote: > > > > What if the user would be to switch shell or to install their own? > > > > I do not think one should depend on shell history to log all what > > user does. Best way to implement something like watch(8) to check > > the ttys you want or to automatically start when someone attaches > > to a tty. Again, this is also flawed.. what if someone simply > If you are that interested about what a particular user is doing on your > system, should they even have an account? :) If an account is compromised then it's nice to have a nice concise log of what occured. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message