Can I log vi activity?

Question

Is there any method to log vi activities? I suspect that another user is issuing commands by going into the shell inside the vi editor, apparently those command doesn't record into history.

score 7 · Answer 1 · answered Feb 13 '11 at 17:17

7

How are you logging their activities right now? The easiest is to block them from launching shells from vi.

# vi /home/user/.exrc
set exrc
set shell=/bin/false
# chown root:root /home/user/.exrc
# chmod 644 /home/user/.exrc
# chattr +i /home/user/.exrc

If you're using a special shell to log their commands, you could change vi to use that shell only.

answered Feb 13 '11 at 17:17

Steven

3,009
18
18

+1 for a good simple way to restrict vi access. – Phil Hollenback Feb 13 '11 at 17:49
2

but it looks easy to bypass: "vim -u /dev/null". – jlliagre Feb 13 '11 at 22:09
Yes, this is essentially an unsolvable problem. The minute someone gets access to your system via a login, they can subvert the machine. The best you can do is make it really difficult. – Phil Hollenback Feb 14 '11 at 00:24

score 6 · Accepted Answer · answered Feb 13 '11 at 21:51

6

You can also turn on process accounting ( s/can/should/ !)

You can then use:

lastcomm(1)

to see the command run and if they were run after a fork, with or without an exec.

Combined with a host based IDS this should give you what you need "that the King's justice may be done upon him."

answered Feb 13 '11 at 21:51

chiggsy

1,576
1
15
20

+1 for a good point about accounting. – Phil Hollenback Feb 14 '11 at 00:24

score 4 · Answer 3 · answered Feb 13 '11 at 17:46

Are you talking about the shell history? vi shell mode (:sh) launches the user's default shell If that is bash then you can make sure that history logging is always enabled by editing the global /etc/bashrc and adding:

set HISTFILE=~/.bash_history
shopt -s histappend
PROMPT_COMMAND='history -a'

that will ensure that every user command gets logged to a file, it doesn't get overwritten, and it gets updated every time the shell prompt appears.

Note that users can override this in their personal ~/.bashrc so this is not an absolute guarantee that logging will happen.

Some versions of vi (like nvi) support a safe mode that disables shell access, via starting vi as nvi -S. You could set a global alias in /etc/bashrc to force this mode by default as well.

Note that in general the issue of users getting to the shell via unexpected means is a classic unix problem. There's no way to disable this completely, the best you can do is try to limit the access by default. A sophisticated user (or even a user who knows how to use google) can always get around these restrictions. For example if a user doesn't want his shell history logged he could always just exec a new copy of the shell with whatever options he wanted to use.

Here's a great writeup of how to force logging in bash and the ways that logging can be circumvented.

Finally, have you considered just talking to the user to determine what they are doing? 99% of the time simple verbal communication can clear up any confusion. If you are logging this user's activity because you don't trust them, maybe you can talk to them about your concerns.

Can I log vi activity?

3 Answers3