As a server administration you may need to record\/save all user terminal activity, so that you can check and identify the problem, if anything happened wrong on server.<\/p>\n
It can be done easily using script command. you can done this by adding below script to common \u201cprofile\u201d file at \/etc\/profile. Now that is all automated process whenever any user logged in server the process will start and recorded all the terminal activity.<\/p>\n
Use the below command to find whether the package is installed or not.<\/p>\n
root@cpanel [~]# yum list installed | grep util-linux-ng\r\nutil-linux-ng.x86_64 2.17.2-12.24.el6<\/pre>\n<\/div>\nThe output is clearly shows script package is already installed on server.<\/p>\n
2) How to find out common profile file ?<\/strong><\/h3>\n
Use the below command to find out common profile file.<\/p>\n
\nfind \/ -name \"profile\"\r\n\/usr\/share\/cagefs\/etc\/profile\r\n\/usr\/local\/rvglobalsoft\/rvsubversion\/profile<\/pre>\n<\/div>\nThe common profile is located at \/etc\/profile.<\/p>\n
3) How to add the below script to \/etc\/profile file ?<\/p>\n
Just open the \/etc\/profile file using your favourite text editor and add the below code. Make sure the output location is already present if not you need to create it and the file should have full permission (Like 777) so that all the user activity can be written.<\/p>\n
\nnano \/usr\/share\/cagefs\/etc\/profile<\/pre>\n<\/div>\nYou can add below code at the end of file:<\/p>\n
\n# Record terminal sessions.\r\nif [ \"x$SESSION_RECORD\" = \"x\" ]\r\nthen\r\ntimestamp=`date \"+%m%d%Y%H%M\"`\r\noutput=\/var\/log\/session\/session.$USER.$$.$timestamp\r\nSESSION_RECORD=started\r\nexport SESSION_RECORD\r\nscript -t -f -q 2>${output}.timing $output\r\nexit\r\nfi<\/pre>\n<\/div>\n4) Create the directory ?<\/strong><\/h3>\n
Now, I\u2019m going to create the folder called session at \/var\/log. So that all the activity recorded under session directory.<\/p>\n
\nmkdir \/var\/log\/session\r\n\r\nroot@cpanel11-nl [\/var\/log]# ls -l\r\ntotal 518372\r\ndrwxr-xr-x 12 root root 4096 Aug 19 08:50 .\/\r\ndrwxr-xr-x 27 root root 4096 Aug 16 02:18 ..\/\r\n-rw------- 1 root root 14309 Mar 7 2015 anaconda.ifcfg.log\r\n-rw------- 1 root root 35534 Mar 7 2015 anaconda.log\r\n-rw------- 1 root root 188562 Mar 7 2015 anaconda.program.log\r\n-rw------- 1 root root 171850 Mar 7 2015 anaconda.storage.log\r\n-rw------- 1 root root 98626 Mar 7 2015 anaconda.syslog\r\n-rw------- 1 root root 80808 Mar 7 2015 anaconda.xlog\r\n-rw------- 1 root root 159817 Mar 7 2015 anaconda.yum.log\r\ndrwxr-x--- 2 root root 4096 Aug 18 21:39 audit\/\r\ndrwxr-xr-x 4 root wheel 4096 Jul 25 16:46 bandwidth\/\r\n-rw-r--r-- 2 root root 13111 Jul 7 04:14 boot.log\r\n-rw------- 1 root utmp 5376 Aug 12 13:10 btmp\r\n-rw------- 1 root utmp 2688 Jul 18 02:01 btmp-20160801\r\n-rw-r--r-- 1 root root 22528 Aug 19 07:54 cagefs.log\r\n-rw-r--r-- 1 root root 23135 Jan 1 2016 cagefs.log-20160101\r\n-rw-r--r-- 1 root root 24736 Feb 1 2016 cagefs.log-20160201\r\n-rw-r--r-- 1 root root 27158 Mar 1 08:13 cagefs.log-20160301\r\n-rw-r--r-- 1 root root 18835 Apr 1 09:37 cagefs.log-20160401\r\n-rw-r--r-- 1 root root 28644 May 1 08:13 cagefs.log-20160501\r\n-rw-r--r-- 1 root root 31271 Jun 1 08:17 cagefs.log-20160601\r\n-rw-r--r-- 1 root root 35434 Jun 30 23:41 cagefs.log-20160701\r\n-rw-r--r-- 1 root root 26223 Aug 1 02:17 cagefs.log-20160801\r\n-rw-r--r-- 1 root root 5890 Aug 19 06:03 cagefs-update.log\r\n-rw------- 1 root root 312545869 Aug 19 08:52 chkservd.log\r\n-rw------- 1 clamav clamav 392439 Aug 19 02:11 clam-update.log\r\n-rw-r--r-- 1 root root 18447 Mar 7 2015 cldeploy.log\r\n-rw------- 1 root root 13315853 Jul 24 03:15 maillog-20160724\r\n-rw------- 1 root root 12868372 Jul 31 03:25 maillog-20160731\r\n-rw------- 1 root root 12285833 Aug 7 03:35 maillog-20160807\r\n-rw------- 1 root root 12446233 Aug 14 03:33 maillog-20160814\r\n-rw------- 1 root root 9465513 Aug 19 08:52 messages\r\n-rw------- 1 root root 15276153 Jul 24 03:15 messages-20160724\r\n-rw------- 1 root root 15525716 Jul 31 03:25 messages-20160731\r\n-rw------- 1 root root 43212485 Aug 7 03:35 messages-20160807\r\n-rw------- 1 root root 15914235 Aug 14 03:33 messages-20160814\r\ndrwxr-xr-x 2 munin munin 4096 Oct 23 2015 munin\/\r\n-rw-r--r-- 1 root root 0 Nov 18 2015 nscd.log\r\n-rw------- 1 root root 71871 Mar 8 2015 quota_enable.log\r\ndrwxr-xr-x 2 root root 4096 Aug 14 03:33 rkhunter\/\r\n-rw-r--r-- 1 root root 0 Aug 4 2015 rkhunter.log\r\ndrwxr-xr-x 2 root root 4096 Aug 19 00:00 sa\/\r\n-rw------- 1 root root 20456 Aug 19 08:48 secure\r\n-rw------- 1 root root 16213 Jul 24 03:15 secure-20160724\r\n-rw------- 1 root root 16342 Jul 31 03:25 secure-20160731\r\n-rw------- 1 root root 46039 Aug 7 03:35 secure-20160807\r\n-rw------- 1 root root 31438 Aug 14 03:33 secure-20160814\r\ndrwxr-xr-x 2 root root 4096 Aug 19 08:50 session\/\r\n-rw------- 1 root root 0 Aug 14 03:33 spooler\r\n\r\n<\/pre>\n<\/div>\nThe above output clearly shows, the session directory created under \/var\/log. By default all the folder having only 755 file permission.<\/p>\n
5) Change the directory permission from 755 to 777 ?<\/strong><\/h3>\n
Now, I\u2019m going to change the directory permission from 755 to 777. So that all the user can write their activity under session directory.<\/p>\n
6) Login with some other users and do some activity in terminal ?<\/strong><\/h3>\n
Now, I\u2019m going login and doing some activity in all the terminal to check whether its working properly or not.<\/p>\n
\nlogin as: sarawhite\r\nsarawhite@96.212.103.187's password:\r\nLast login: Fri Aug 19 07:10:39 2016 from 103.8.113.180\r\nsarawhite@0sarawhite.cpanelserver.com [~]# w\r\n08:57:36 up 43 days, 4:44, 5 users, load average: 1.20, 0.91, 0.84\r\nUSER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT\r\nsarawhit pts\/0 119.153.141.59 05:21 2:01 0.01s 0.01s -bash\r\nsarawhit pts\/1 103.8.113.180 07:08 1:48m 0.01s 0.01s -bash\r\nsarawhit pts\/2 119.153.141.59 08:57 0.00s 0.00s 0.00s w<\/pre>\n<\/div>\n7) Checking session has been recorded or not ?<\/strong><\/h3>\n
Now, I\u2019m going to check whether the session got recorded or not under \/var\/log\/session.<\/p>\n
\nroot@cpanel [\/var\/log\/session]# ls -la\r\ntotal 150\r\n-rw-rw-r--. 1 sarawhit sarawhit 81 Aug 18 12:34 session.sarawhit.25769.021420141234\r\n-rw-rw-r--. 1 sarawhit sarawhit 12 Aug 18 12:34 session.sarawhit.25769.021420141234.timing\r\n-rw-rw-r--. 1 sarawhit sarawhit 690 Aug 17 15:36 session.sarawhit.28250.021520141536\r\n-rw-rw-r--. 1 sarawhit sarawhit 72 Feb 15 15:36 session.sarawhit.28250.021520141536.timing<\/pre>\n<\/div>\nThe output clearly shows all the user\u2019s terminal activity has been recorded.<\/p>\n
8) I\u2019m going to check recorded session data ?<\/strong><\/h3>\n
Now, I\u2019m going to check sarawhit user recorded session whether its captured the data or not.<\/p>\n