Skip to content

Instantly share code, notes, and snippets.

@tksunw
Last active Dec 28, 2015
Embed
What would you like to do?
bashhist.c.patch. originally for bash 4.1, this change updates the log entries sent to syslog to match the format of the BOFH hardened TCSH shell. consistent log formats makes it easier to detect anomolies. goes with the blog post at http://www.timkennedy.net/2010/12/logging-shell-commands-to-syslog-on.html
--- bashhist.c.orig 2010-12-07 04:16:12.692508765 -0500
+++ bashhist.c 2010-12-07 04:43:19.635794444 -0500
@@ -709,12 +709,12 @@
char trunc[SYSLOG_MAXLEN];
if (strlen(line) < SYSLOG_MAXLEN)
- syslog (SYSLOG_FACILITY|SYSLOG_LEVEL, "HISTORY: PID=%d UID=%d %s", getpid(), current_user.uid, line);
+ syslog (SYSLOG_FACILITY|SYSLOG_LEVEL, "HISTORY: [%s UID=%d] %s", current_user.user_name, current_user.uid, line);
else
{
strncpy (trunc, line, SYSLOG_MAXLEN);
trunc[SYSLOG_MAXLEN - 1] = '\0';
- syslog (SYSLOG_FACILITY|SYSLOG_LEVEL, "HISTORY (TRUNCATED): PID=%d UID=%d %s", getpid(), current_user.uid, trunc);
+ syslog (SYSLOG_FACILITY|SYSLOG_LEVEL, "HISTORY (TRUNCATED): [%s UID=%d] %s", current_user.user_name, current_user.uid, trunc);
}
}
#endif
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment