Tag: security

On the Linux Server, the history command shows previously executed commands. If you have many people working on a server, it is better log IP address of the user who run the command along with time for security reason.

To log, IP and date, create a file

vi /usr/local/bin/sok_detailed_history

In the file, add

#!/bin/bash
# Author: ServerOK.in
# Email: [email protected]
# Web; https://serverok.in

SET_IP=`echo -n $SSH_CLIENT|cut -d' ' -f1`
if [[ `tail -n1 ~/.bash_history|rev|cut -c -4|rev` != `date +%Y` ]]
then
    sed -i "\$s/$/ #entered by `echo -n $SET_IP` on `date`/g" ~/.bash_history
fi

Make it executable

chmod 755 /usr/local/bin/sok_detailed_history

Create file

vi  /etc/profile.d/sok_detailed_history.sh

Add the following to the file

export PROMPT_COMMAND="history -a; /bin/bash /usr/local/bin/sok_detailed_history"

Log out and log in to the server. Now your history will also record IP address that is used to login to server. PROMPT_COMMAND environment variable allows you to execute a command every time command promt is shown. To see how PROMPT_COMMAND works, just run

PROMPT_COMMAND="echo I am here"

Example

boby@sok-01:~$ PROMPT_COMMAND="echo I am here"
I am here
boby@sok-01:~$ 
I am here
boby@sok-01:~$ 
I am here
boby@sok-01:~$ 

Every time I press enter, the command specified in the PROMPT_COMMAND variable gets executed. Just close the current terminal to undo the change.

See history