Is it possible to audit the disabling of bash history or environment variables

Discussion in 'Installation/Configuration' started by responsys_cm, Jun 28, 2012.

  1. responsys_cm

    responsys_cm New Member

    I've seen a number of posts by Anonymous detailing how they have hacked into some of their victims. The first thing they do when they get a shell is disable the bash history.

    It seems that set, unset, and history are "internal" commands to the OS and don't have an executable associated with them. Is there a way to audit users who unset their history file or run history -c?

    Thx.

    Craig
     
: auditing

Share This Page