See past commands issued

LinuxLegends

New Member
Joined
Jul 18, 2022
Messages
13
Reaction score
1
Credits
135
This is a hypothetical question

So let's say my friend promises I can trust him to SSH into my Debian-based Linux VPS hosted on a VPS provider

Is there a way to view every command he's entered in the logs without the possibility that he deleted malicious log entries?
Or some program that can monitor all commands entered?
Or can I set him up as a non-root sudo, then monitor all activity as root?
 


Are you wanting to give him an account with full sudo rights or just a regular account, if the latter it's not really needed since they can't break anything with a normal user account or access anything that would require root access. If you have doubts about if you can really trust this friend I wouldn't give him access to your vps, but if you still want to you can use audit rules.
 
Last edited:
If yo don't want to learn a bunch...

Up front, this may need a little massaging for your particular shell. I use ksh.

Set him up as regular user (why take the chance). If the person proves themselves trust worthy you can always open up the access.

In his .profile add the command set -o vi and whatever else you find necessary. With that, once you su to his account it's pretty easy to see what's been typed. To see past command tap the escape key, then tap the "k" key. Keep tapping to go back in the history.

Addendum,
If you do use the korn shell, if you're looking for a particular command that was typed, after hitting esc k, type / then type the name of the command you're looking for. If you want to exit the search, type dd
 
Last edited:

Staff online


Top