Monitor user history

[svar]

Hi,

I have list of users who knows root password, Those users login as users then later switch as root user or super user.

My requirement is that I want to monitor the users action or the commands used by them, I tried to get it from the history file but I was unable to do it, because the users history is stored in both users history as well as root history. Do you have any Idea or solution?

[peter]

Try sudo and disable the users’ ability to do:

• su –
• visudo

I think you can set sudo to log commands. You’ll need to either disable the ability for the users to edit the log files, or you could just log to a remote log host to which they don’t have access.

[Kernel_Killer]

I would personally stray away from sudo, but that’s me (too many exploits, too often). Use the HISTTIMEFORMAT variable in your bash rc/profile file to add timestamps to ‘history’, then use ‘last’ to find out who was logged in, and when. There is also ‘whowatch’, and ttysnoop; to watch them in real-time.

[svar]

Hi friends,

I am an system administrator, I want to monitor the users activity, My requrement is to write a script and send the user activity to my manager. Is this is possible?