Browse Source

Update README.md

pull/1/head
Marc Schöchlin 12 years ago
parent
commit
00d9c29948
1 changed files with 27 additions and 20 deletions
  1. +27
    -20
      README.md

+ 27
- 20
README.md View File

@ -9,14 +9,15 @@ This project also provides tools to setup auditable shell sessions.
Usage Usage
----- -----
* Record session
```
script -t /tmp/foo/typescript 2> /tmp/foo/timing
```
* Replay session
```
scriptreplay -t timing typescript
```
* Record session
```bash
script -t /tmp/foo/typescript 2> /tmp/foo/timing
```
* Replay session
```bash
scriptreplay -t timing typescript
```
@ -121,16 +122,18 @@ Auditshell submits the typescript and the timings to syslog which prevents modif
The logged information can also be forwarded to secured logging servers using standard syslog logfile distribution. The logged information can also be forwarded to secured logging servers using standard syslog logfile distribution.
* Install the following tools to /usr/local/bin * Install the following tools to /usr/local/bin
* scriptreplay
* helpers/auditshell
* helpers/auditshell_create_sessionfiles
* scriptreplay
* helpers/auditshell
* helpers/auditshell_create_sessionfiles
* Set permission and owner * Set permission and owner
```
chown root:root /usr/local/bin/{scriptreplay,auditshell,auditshell_create_sessionfiles}
chmod 755 /usr/local/bin/{scriptreplay,auditshel,auditshell_create_sessionfiles}
```
```bash
chown root:root /usr/local/bin/{scriptreplay,auditshell,auditshell_create_sessionfiles}
chmod 755 /usr/local/bin/{scriptreplay,auditshel,auditshell_create_sessionfiles}
```
* Patch an install custom "script" implementation * Patch an install custom "script" implementation
```
```bash
cd helpers/ cd helpers/
git clone git://git.kernel.org/pub/scm/utils/util-linux/util-linux.git git clone git://git.kernel.org/pub/scm/utils/util-linux/util-linux.git
cd util-linux.git cd util-linux.git
@ -145,7 +148,8 @@ The logged information can also be forwarded to secured logging servers using st
* Disable string escaping on system which are using rsyslogd (i.e. Ubuntu systems) * Disable string escaping on system which are using rsyslogd (i.e. Ubuntu systems)
* Redirect the auditshell logs to another logfile using syslog configuration * Redirect the auditshell logs to another logfile using syslog configuration
* Change shell of user * Change shell of user
```
```bash
chsh -s /usr/local/bin/auditshell <user> chsh -s /usr/local/bin/auditshell <user>
``` ```
@ -155,10 +159,13 @@ Watch auditshell sessions
* Start session, and execute commands * Start session, and execute commands
* Extract session files * Extract session files
```
```bash
/usr/local/bin/auditshell_create_sessionfiles /var/log/messages /tmp/foo /usr/local/bin/auditshell_create_sessionfiles /var/log/messages /tmp/foo
``` ```
* Replay session * Replay session
```
scriptreplay -t /tmp/foo/2013-09-11_18-47-45.user1.11931.timing /tmp/foo/2013-09-11_18-47-45.user1.11931.typescript
```bash
scriptreplay -t /tmp/foo/2013-09-11_18-47-45.user1.11931.timing \
/tmp/foo/2013-09-11_18-47-45.user1.11931.typescript
``` ```

Loading…
Cancel
Save