diff --git a/README.md b/README.md index 540405e..9ab5cd7 100644 --- a/README.md +++ b/README.md @@ -134,7 +134,7 @@ The logged information can also be forwarded to secured logging servers using st apt-get install libtoolize libtool autopoint pkg-config make gcc zypper install libtool gettext-tools pkg-config make gcc autoconf automake ``` - * Patch an install custom "script" implementation + * Patch and install custom "script" implementation ```bash cd helpers/ diff --git a/helpers/auditshell b/helpers/auditshell index 9c13d17..80698da 100755 --- a/helpers/auditshell +++ b/helpers/auditshell @@ -2,6 +2,12 @@ IDENT="`date --date="today" "+%Y-%m-%d_%H-%M-%S"`.`whoami`.$$" + +# This is a file transfer, no audit shell neccessary +if (echo "$@"|egrep -q ".*scp.*");then + exec /bin/sh "$@" +fi + TYPESCRIPT="auditshell.typescript.${IDENT}" TIMING="auditshell.timing.${IDENT}" @@ -16,6 +22,11 @@ cat < >(logger -t $TYPESCRIPT) 2> >(logger -t $TIMING) +exec /usr/local/bin/script -d -e -f -q -t 5 \ + 5> >(base64|logger -t $TYPESCRIPT) \ + 2> >(base64|logger -t $TIMING) diff --git a/helpers/auditshell_create_sessionfiles b/helpers/auditshell_create_sessionfiles index 2d1126c..bf23113 100755 --- a/helpers/auditshell_create_sessionfiles +++ b/helpers/auditshell_create_sessionfiles @@ -12,6 +12,13 @@ if ( (!defined $file) || (!defined $file) ){ exit(1); } +chdir($dir); + +unless(chdir($dir)) +{ + die "Error: Can't change directory!: $!"; +} + open( INFILE, "<$file" ) || die "input-file '$file' could not be opened"; my $fdcache = {}; @@ -25,10 +32,10 @@ while (my $zeile = ) { if ( !exists $fdcache->{$ident}){ $fdcache->{$ident} = {}; - print "Open $ident.typescript\n"; - $fdcache->{$ident}->{typescript} = FileHandle->new("> $ident.typescript"); - print "Open $ident.timing\n"; - $fdcache->{$ident}->{timing} = FileHandle->new("> $ident.timing"); + print "Create $ident.typescript.base64\n"; + $fdcache->{$ident}->{typescript} = FileHandle->new("> $ident.typescript.base64"); + print "Create $ident.timing.base64\n"; + $fdcache->{$ident}->{timing} = FileHandle->new("> $ident.timing.base64"); } my $fd = $fdcache->{$ident}->{$type}; @@ -41,4 +48,10 @@ close(INFILE); foreach my $ident(keys %{$fdcache}){ close $fdcache->{$ident}->{typescript}; close $fdcache->{$ident}->{timing}; + system("base64 -d $ident.typescript.base64 |gzip -c > $ident.typescript.gz"); + system("base64 -d $ident.timing.base64 |gzip -c > $ident.timing.gz"); + unlink("$ident.timing.base64"); + unlink("$ident.typescript.base64"); + print "removed $ident.typescript.base64, created $ident.typescript.gz\n"; + print "removed $ident.timing.base64, created $ident.timing.gz\n"; }