On Thursday 15 July 2004 10:14 pm, Michael Gale wrote: > Hello, > > I know this is not a netfilter question but I was wondering if any one > knows of a way to log all user activity. So if a user logs in via a SSH > connection I would like to log all user activity. What files the view or > alter and any other commands ? Try a rootkit :) If an attacker can implant a keystroke logger in your system, you should be able to too :) Other than that - it's the beauty of Open Source Software - you can change the SSH daemon to do whatever you want it to, on your system.... Regards, Antony. -- "It would appear we have reached the limits of what it is possible to achieve with computer technology, although one should be careful with such statements; they tend to sound pretty silly in five years." - John von Neumann (1949) Please reply to the list; please don't CC me.