Hello,
I know this is not a netfilter question but I was wondering if any one knows of a way to log all user activity. So if a user logs in via a SSH connection I would like to log all user activity. What files the view or alter and any other commands ?
Yup, completely OT for this mailing list...
What you are looking for is called auditing. There are some projects for implementing it on Linux, but AFAIK nothing final and stable. If I understood it correctly (and I might be completely wrong here), the major problem is that core group of Linux kernel developers is reluctant in putting appropriate auditing hooks into kernel (not even as an compile time option for those that need it), for whatever reason.
Note that good auditing is not trivial to configure, and depending on what you want to log, auditing can produce *huge* log files.
-- Aleksandar Milivojevic <amilivojevic@xxxxxx> Pollard Banknote Limited Systems Administrator 1499 Buffalo Place Tel: (204) 474-2323 ext 276 Winnipeg, MB R3T 1L7
