Bash – How to best track adventures of a novice administrator

auditbashdebianlinuxtypescript

I have this user that has limited sudo privileges, yet he manages to screw up from time to time. I would like to keep an eye on his adventures, so that I can reverse any damage with less digging. Ideally, I'd want a service with the following functionality being well integrated and presentable

Tracks shell input and output like ttyrec (or script or sudo if logging is set up) and can replay the session like ttyplay (or scriptreplay or sudoreplay) Compatibility with ncurses programs would be nice, but not necessary, ttyrec can do it apparently.
Tracks file access, creation and modification. Ideally, it could also backup a file each time it is changed or deleted.

So far I have found several tools that I would have to set up to get most of the requested functionality, but I haven't come across an OSS product that would integrate them nicely (Lynis community edition isn't really clear on the functionality).

I could put ttyrec $(mktemp), script $(mktemp) or sudo -u $USER -i (with sudo logging set up) in his .bashrc to log the shell IO.
Set up auditing to track file access in some dirs, like /usr, /etc, /var.
Create a LVM snapshot when he logs in, but that is a bit of an overkill and might degrade system performance.

EDIT: ttyrec seems to be a better alternative to script, it would satisfy all my IO logging requirements. Now I need to find a good way to log file manipulation.

I'll be grateful for any suggestions or recommendations of best practices.

Best Answer

Perhaps you could encourage your admin to use good logging practices. Gnu Screen does this quite nicely. It adds quite a bit more functionality than you're looking for, and also has the ability to toggle logging, so he could turn it off himself, if he desired. It lacks the replay functionality, but it could be part of a solution, in that it tracks most input and output when logging is on.

In your use case, you would want to add deflog on to the screenrc file to have new windows default with logging on.

This has the disadvantage of being toggleable by your user however.

You can accomplish the file monitoring using Monit, which watches file checksums for changes, and can also check conditions of various services. Combine this with something like a rsync on a cronjob (since you should have something like that anyways) and you have a fairly solid idea of exactly what's going on on the server, especially if you turn on really tight timestamps in screen and trust your user not to fiddle with the logging settings.

By combining these tools, you should have a fairly robust and lightweight system that lets you keep a decent eye on your user while ensuring a basic level of salvageability.

Related Solutions

Bash – How to change the command to run without superuser privilleges but with the changed limit value

sudo sh -c "ulimit -c 1024 && sudo -u nobody -c \"sleep 100\""

Efficient Bash Calculations – Best Practices

Please don't do this in the shell. There is no amount of tweaking that would ever make it remotely efficient. Shell loops are slow and using the shell to parse text is just bad practice. Your whole script can be replaced by this simple awk one-liner which will be orders of magnitude faster:

awk 'BEGIN{E = exp(1);} $1>0{tot+=log($1); c++} END{m=tot/c; printf "%.2f\n", E^m}' file

For example, if I run that on a file containing the numbers from 1 to 100, I get:

$ seq 100 > file
$ awk 'BEGIN{E = exp(1);} $1>0{tot+=log($1); c++} END{m=tot/c; printf "%.2f\n", E^m}' file
37.99

In terms of speed, I tested your shell solution, your python solution and the awk I gave above on a file containing the numbers from 1 to 10000:

## Shell
$ time foo.sh
3677.54

real    1m0.720s
user    0m48.720s
sys     0m24.733s

### Python
$ time foo.py
The Geometric Mean is:  3680.827182220091

real    0m0.149s
user    0m0.121s
sys     0m0.027s


### Awk
$ time awk 'BEGIN{E = exp(1);} $1>0{tot+=log($1); c++} END{m=tot/c; printf "%.2f\n", E^m}' input.txt
3680.83

real    0m0.011s
user    0m0.010s
sys     0m0.001s

As you can see, the awk is even faster than the python and far simpler to write. You can also make it into a "shell" script, if you like. Either like this:

#!/bin/awk -f

BEGIN{
    E = exp(1);
} 
$1>0{
    tot+=log($1);
    c++;
}
 
END{
    m=tot/c; printf "%.2f\n", E^m
}

or by saving the command in a shell script:

#!/bin/sh
awk 'BEGIN{E = exp(1);} $1>0{tot+=log($1); c++;} END{m=tot/c; printf "%.2f\n", E^m}' "$1"

Best Answer

Related Solutions

Bash – How to change the command to run without superuser privilleges but with the changed limit value

Efficient Bash Calculations – Best Practices

Related Question