How to shadow copy records to a file?

T

Taras Labiak2014-08-14 13:10:26

linux

Taras Labiak, 2014-08-14 13:10:26

You need to keep track of changes made to .bash_history so that you can see which lines the user has deleted from this file. Those. some background program or service is supposed to be launched, which is guaranteed to save all commands entered by the root user. Perhaps you can recommend some spyware.
PS In principle, this task is not difficult to implement and most with the help of the poll system call

Reply

Answer the question

In order to leave comments, you need to log in

2 answer(s)

A

Andrey Burov, 2014-08-14
@BuriK666

inotify, and in general if the user has root, he can do anything.
+ Commands starting with a space are not written to history!

S

s1dney, 2014-08-14
@s1dney

If for the root, then this is a completely stupid idea. What's stopping him from killing this background program and doing history -c ?
And so, yes - inotify in the wrapper of a small bash script, the package is in all standard turnips.