diff --git a/README.md b/README.md index a2019af..1ede0bb 100644 --- a/README.md +++ b/README.md @@ -9,14 +9,15 @@ This project also provides tools to setup auditable shell sessions. Usage ----- - * Record session -``` -script -t /tmp/foo/typescript 2> /tmp/foo/timing -``` - * Replay session -``` -scriptreplay -t timing typescript -``` + * Record session + ```bash + script -t /tmp/foo/typescript 2> /tmp/foo/timing + ``` + + * Replay session + ```bash + scriptreplay -t timing typescript + ``` @@ -121,16 +122,18 @@ Auditshell submits the typescript and the timings to syslog which prevents modif The logged information can also be forwarded to secured logging servers using standard syslog logfile distribution. * Install the following tools to /usr/local/bin - * scriptreplay - * helpers/auditshell - * helpers/auditshell_create_sessionfiles + * scriptreplay + * helpers/auditshell + * helpers/auditshell_create_sessionfiles * Set permission and owner - ``` - chown root:root /usr/local/bin/{scriptreplay,auditshell,auditshell_create_sessionfiles} - chmod 755 /usr/local/bin/{scriptreplay,auditshel,auditshell_create_sessionfiles} - ``` + + ```bash + chown root:root /usr/local/bin/{scriptreplay,auditshell,auditshell_create_sessionfiles} + chmod 755 /usr/local/bin/{scriptreplay,auditshel,auditshell_create_sessionfiles} + ``` * Patch an install custom "script" implementation - ``` + + ```bash cd helpers/ git clone git://git.kernel.org/pub/scm/utils/util-linux/util-linux.git cd util-linux.git @@ -145,7 +148,8 @@ The logged information can also be forwarded to secured logging servers using st * Disable string escaping on system which are using rsyslogd (i.e. Ubuntu systems) * Redirect the auditshell logs to another logfile using syslog configuration * Change shell of user - ``` + + ```bash chsh -s /usr/local/bin/auditshell ``` @@ -155,10 +159,13 @@ Watch auditshell sessions * Start session, and execute commands * Extract session files - ``` + + ```bash /usr/local/bin/auditshell_create_sessionfiles /var/log/messages /tmp/foo ``` * Replay session - ``` - scriptreplay -t /tmp/foo/2013-09-11_18-47-45.user1.11931.timing /tmp/foo/2013-09-11_18-47-45.user1.11931.typescript + + ```bash + scriptreplay -t /tmp/foo/2013-09-11_18-47-45.user1.11931.timing \ + /tmp/foo/2013-09-11_18-47-45.user1.11931.typescript ```