linux eternal bash history all users secured

posted this in Linux on May 20th, 2011

I use this on my unix/linux boxes for eternal bash history for all users (place in /etc/bashrc)

if [ "$BASH" ]; then export HISTTIMEFORMAT="%Y-%m-%d_%H:%M:%S " export PROMPT_COMMAND="${PROMPT_COMMAND:+$PROMPT_COMMAND ; }"'echo "`date +'%y.%m.%d-%H:%M:%S:'`" $USER "("$ORIGINAL_USER")" "COMMAND: " "$(history 1 | cut -c8-)" >> /var/log/bash_eternal_history' alias ehistory='cat /var/log/bash_eternal_history' readonly PROMPT_COMMAND readonly HISTSIZE readonly HISTFILE readonly HOME readonly HISTIGNORE readonly HISTCONTROL fi

1 2 3 4 5 6 7 8 9 10 11

if [ "$BASH" ]; then         export HISTTIMEFORMAT="%Y-%m-%d_%H:%M:%S "         export PROMPT_COMMAND="${PROMPT_COMMAND:+$PROMPT_COMMAND ; }"'echo "`date +'%y.%m.%d-%H:%M:%S:'`" $USER "("$ORIGINAL_USER")" "COMMAND: " "$(history 1 | cut -c8-)" >> /var/log/bash_eternal_history'         alias ehistory='cat /var/log/bash_eternal_history'         readonly PROMPT_COMMAND         readonly HISTSIZE         readonly HISTFILE         readonly HOME         readonly HISTIGNORE         readonly HISTCONTROL fi

Then as root run the commands:

touch /var/log/bash_eternal_history chmod 777 /var/log/bash_eternal_history chattr +a /var/log/bash_eternal_history

1 2 3

touch /var/log/bash_eternal_history chmod 777 /var/log/bash_eternal_history chattr +a /var/log/bash_eternal_history

on BSD freebsd the last command won’t work, use this instead:

# find /var/log -type f -name 'bash_eternal_history' -exec chflags uappnd {} \;

1	# find /var/log -type f -name 'bash_eternal_history' -exec chflags uappnd {} \;

Linux

3 comments to linux eternal bash history all users secured

• Alex

  October 10, 2011 at 8:51 am · Reply

  export PROMPT_COMMAND=”${PROMPT_COMMAND:+$PROMPT_COMMAND ; }”‘echo “`date +’%y.%m.%d-%H:M:%S:’`” $USER “(“$ORIGINAL_USER”)” “COMMAND: ” “$(history 1 | cut -c8-)” >> /var/log/bash_eternal_history’

  should be
  export PROMPT_COMMAND=”${PROMPT_COMMAND:+$PROMPT_COMMAND ; }”‘echo “`date +’%y.%m.%d-%H:%M:%S:’`” $USER “(“$ORIGINAL_USER”)” “COMMAND: ” “$(history 1 | cut -c8-)” >> /var/log/bash_eternal_history’

  You’re missing a % before the M after “`date” which puts an M in the entry instead of the minute.

  Who’s got your back? This guy.

  • ssstonebraker

    October 10, 2011 at 11:24 am · Reply

    You da man! Thank you! Updated!

• ssstonebraker

  May 10, 2013 at 3:40 am · Reply

  Another alternative with syslog (only for root user):
  http://jablonskis.org/2011/howto-log-bash-history-to-syslog/