Archiving History files

[mmcgrew1 at mail.csuchico.edu (Michael McGrew)]

This looks like a nifty solution.

http://blog.rootshell.be/2009/02/28/bash-history-to-syslog/

On Tue, Jan 19, 2010 at 7:46 AM, Dave Ockwell-Jenner
<doj at primeinfosec.com>wrote:

> Monkey Daemon wrote:
> > Hi,
> >
> > I've just discovered a system on which one of our darling users has
> > decided adding a script to his .bash_logout file that removes
> > .bash_history on logout is a clever thing to do.
> >
> > Is there a way to take a copy of the .bash_history file before it is
> > deleted? This user obviously has something to hide as far as I'm
> > concerned, so I need to archive this file to present it as evidence.
> How about compiling a custom version of bash that writes the history
> file out to an alternate location? I have used that technique in the
> past for a similar situation and it was quite effective. There is little
> chance someone would suspect a 'trojaned' shell, typically.
>
> Cheers,
> Dave.
> _______________________________________________
> Pauldotcom mailing list
> Pauldotcom at mail.pauldotcom.com
> http://mail.pauldotcom.com/cgi-bin/mailman/listinfo/pauldotcom
> Main Web Site: http://pauldotcom.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mail.pauldotcom.com/pipermail/pauldotcom/attachments/20100119/d12b5090/attachment.htm