1

I want to log commands executed by an application server(resin) to catch things like "cat /etc/passwd" or "whoami" being executed by user resin.

However, since the user resin uses a /bin/false shell, I can't just edit bashrc file as suggested here

So what are my options to do that?

user435644
  • 11
  • 1
  • 2
    The solution is auditd - [replace `euid=0`](https://serverfault.com/a/475134/37681) with the UID number for your resin user and you're done. – HBruijn Sep 15 '17 at 07:47

0 Answers0