Root audit

[David Bandel]

On 7/1/07, Dirk Moolman <DirkM at agilitytech.co.za> wrote:
> I need some help.  I would like to audit specific accounts on my linux
> servers. I know you can see the keyboard history, from files like
> .bash_history, etc.
>
> Is it also possible to see for example, files that users updated on the
> system ?  ..... or if they changed network settings ?
>
> For example, let's say you were forced to give someone the root
> password, and you want to trace what they did on the system - can this
> be done ?
>

Just make root run 'script' on each login.  If the script file carries
a datetime on the suffix, several users can login as root and each
will have his own script file.

Ciao,

David A. Bandel
-- 
Focus on the dream, not the competition.
            - Nemesis Air Racing Team motto