Re: how to disable unset HISTORY

2012-10-17 Thread Bryn M. Reeves
On 10/17/2012 12:06 AM, Mark LaPierre wrote: On 10/16/2012 02:52 AM, Tiziana Manfroni wrote: Hi, I have some users that delete .history file (in tcsh shell), so I can't see their commands. Can I disable the command unset history? If it is not possible, what can I do? Thanks in advance

Re: how to disable unset HISTORY

2012-10-17 Thread Frank Murphy
On 16/10/12 11:03, Bryn M. Reeves wrote: On 10/16/2012 07:52 AM, Tiziana Manfroni wrote: Hi, I have some users that delete .history file (in tcsh shell), so I can't see their commands. Can I disable the command unset history? If it is not possible, what can I do? You can't really prevent a

Re: how to disable unset HISTORY

2012-10-17 Thread Errol Mangwiro
involved in mankind; and therefore never send to know for whom the bell tolls; it tolls for thee. -Original Message- From: Alan Cox a...@lxorguk.ukuu.org.uk Date: Tue, 16 Oct 2012 15:50:13 To: users@lists.fedoraproject.org Cc: redwo...@gmail.com Subject: Re: how to disable unset HISTORY You

how to disable unset HISTORY

2012-10-16 Thread Tiziana Manfroni
Hi, I have some users that delete .history file (in tcsh shell), so I can't see their commands. Can I disable the command unset history? If it is not possible, what can I do? Thanks in advance Tiziana -- users mailing list users@lists.fedoraproject.org To unsubscribe or change

Re: how to disable unset HISTORY

2012-10-16 Thread Bryn M. Reeves
On 10/16/2012 07:52 AM, Tiziana Manfroni wrote: Hi, I have some users that delete .history file (in tcsh shell), so I can't see their commands. Can I disable the command unset history? If it is not possible, what can I do? You can't really prevent a user from altering their environment (it's

Re: how to disable unset HISTORY

2012-10-16 Thread Alan Cox
Recent versions of bash can also be compiled with syslog support by defining SYSLOG_HISTORY but if your users are hooked on tcsh that probably won't help (I don't think it's enabled in the Fedora builds anyway). And any remotely malicious intending user will simply go into vi, set the vi

Re: how to disable unset HISTORY

2012-10-16 Thread Reindl Harald
Am 16.10.2012 08:52, schrieb Tiziana Manfroni: Hi, I have some users that delete .history file (in tcsh shell), so I can't see their commands. Can I disable the command unset history? If it is not possible, what can I do? nothing, the file is writeable for the user so if unset doe snot

Re: how to disable unset HISTORY

2012-10-16 Thread G.Wolfe Woodbury
On 10/16/2012 06:03 AM, Bryn M. Reeves wrote: On 10/16/2012 07:52 AM, Tiziana Manfroni wrote: Hi, I have some users that delete .history file (in tcsh shell), so I can't see their commands. Can I disable the command unset history? If it is not possible, what can I do? You can't really

Re: how to disable unset HISTORY

2012-10-16 Thread Alan Cox
You can turn on BSD Process Accounting (which is in the kernel for Fedora) in the system profile. This causes the kernel to dump a record for each process spawned into the system logs. You will want to install and use a tool to analyze the logs and keep them to a reasonable size. BSD

Re: how to disable unset HISTORY

2012-10-16 Thread G.Wolfe Woodbury
On 10/16/2012 11:50 AM, Alan Cox wrote: You can turn on BSD Process Accounting (which is in the kernel for Fedora) in the system profile. This causes the kernel to dump a record for each process spawned into the system logs. You will want to install and use a tool to analyze the logs and

Re: how to disable unset HISTORY

2012-10-16 Thread Mark LaPierre
On 10/16/2012 02:52 AM, Tiziana Manfroni wrote: Hi, I have some users that delete .history file (in tcsh shell), so I can't see their commands. Can I disable the command unset history? If it is not possible, what can I do? Thanks in advance Tiziana If you are creative with scripting you may

Re: how to disable unset HISTORY

2012-10-16 Thread JD
On 10/16/2012 05:06 PM, Mark LaPierre wrote: On 10/16/2012 02:52 AM, Tiziana Manfroni wrote: Hi, I have some users that delete .history file (in tcsh shell), so I can't see their commands. Can I disable the command unset history? If it is not possible, what can I do? Thanks in advance

Re: how to disable unset HISTORY

2012-10-16 Thread JD
On 10/16/2012 05:52 PM, JD wrote: On 10/16/2012 05:06 PM, Mark LaPierre wrote: On 10/16/2012 02:52 AM, Tiziana Manfroni wrote: Hi, I have some users that delete .history file (in tcsh shell), so I can't see their commands. Can I disable the command unset history? If it is not possible, what

Re: how to disable unset HISTORY

2012-10-16 Thread JD
On 10/16/2012 05:06 PM, Mark LaPierre wrote: On 10/16/2012 02:52 AM, Tiziana Manfroni wrote: Hi, I have some users that delete .history file (in tcsh shell), so I can't see their commands. Can I disable the command unset history? If it is not possible, what can I do? Thanks in advance

Re: how to disable unset HISTORY

2012-10-16 Thread Gordon Messmer
On 10/15/2012 11:52 PM, Tiziana Manfroni wrote: If it is not possible, what can I do? Enable the auditing system. Everything else can be trivially disabled or evaded. SuSE actually has some fair documentation for this: