Security Basics mailing list archives

Re: How to track down which commands sudoers set up?


From: Sergio Guzman Lorz <sergio () gridshield net>
Date: Tue, 13 Jun 2006 15:20:24 -0600

Isaac Perez wrote:
You can take a look on .bash_history of the user.
it don't give you the time but the commands.

If you're using bash, then set the variable:

  HISTTIMEFORMAT="%F %T "
in the file .bashrc and export it.

You'll see that the .bash_history file starts using timestamps for the
commands and when you see the historu file using the command history it
translates the timestamps to the format specified in the variable.

You can try modifying the format too.

-- 
Sergio Guzmán
San José, Costa Rica.
Tel: (506) 258-5757 ext 115
http://www.gridshield.net/
Gridshield: Proteccion y Monitoreo de Redes


Current thread: