<html><head></head><body><div style="font-family: Verdana;font-size: 12.0px;"><div>Yes, history is a bash internal command and that's why I opened initally this thread because I wanted to know if there is any chance to track internal bash commands like history as well via auditd. For now it seems pam_tty_audit doesn't do the job.</div>
<div>
<div>
<div name="quote" style="margin:10px 5px 5px 10px; padding: 10px 0 10px 10px; border-left:2px solid #C3D9E5; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
<div style="margin:0 0 10px 0;"><b>Gesendet:</b> Mittwoch, 09. Februar 2022 um 02:09 Uhr<br/>
<b>Von:</b> "Casey Schaufler" <casey@schaufler-ca.com><br/>
<b>An:</b> "André Letterer" <andre.letterer@web.de>, "Richard Guy Briggs" <rgb@redhat.com><br/>
<b>Cc:</b> Linux-audit@redhat.com<br/>
<b>Betreff:</b> Re: How to configure auditd to register like internal bash commands?</div>
<div name="quoted-content">On 2/8/2022 4:24 PM, André Letterer wrote:<br/>
> Yeah, it's a very good start.<br/>
> However it seems it still doesn't do what I want.<br/>
> It seems only changing the 2 files doesn't do the job:<br/>
> nano /etc/pam.d/system-auth<br/>
> session required pam_tty_audit.so disable=* enable=logs log_passwd<br/>
> nano /etc/pam.d/password-auth<br/>
> session required pam_tty_audit.so disable=* enable=logs log_passwd<br/>
> I get much more entries in /var/log/audit/audit.log for user logs like for instance if I su to this one.<br/>
> However unfortunately commands like "history -c" don't still trigger an entry...<br/>
<br/>
There are a significant number of commands that are shell built-ins,<br/>
including "history".<br/>
<br/>
> Is there still a follow-up idea on this?<br/>
> *Gesendet:* Mittwoch, 09. Februar 2022 um 00:20 Uhr<br/>
> *Von:* "Richard Guy Briggs" <rgb@redhat.com><br/>
> *An:* "André Letterer" <andre.letterer@web.de><br/>
> *Cc:* Linux-audit@redhat.com<br/>
> *Betreff:* Re: How to configure auditd to register like internal bash commands?<br/>
> On 2022-02-07 23:37, André Letterer wrote:<br/>
> > Hi folks,<br/>
> ><br/>
> > I would like to have some help on configuring auditd for very short<br/>
> > running commands like<br/>
> > unset ...<br/>
> > set ...<br/>
> > export ...<br/>
> > history -c<br/>
> ><br/>
> > or similar commands.<br/>
> > How would that be possible?<br/>
> > Would you mind please to help me on some knowledge about that?<br/>
><br/>
> You may want to look into pam_tty_audit, but it may flood your logs.<br/>
><br/>
> - RGB<br/>
><br/>
> --<br/>
> Richard Guy Briggs <rgb@redhat.com><br/>
> Sr. S/W Engineer, Kernel Security, Base Operating Systems<br/>
> Remote, Ottawa, Red Hat Canada<br/>
> IRC: rgb, SunRaycer<br/>
> Voice: +1.647.777.2635, Internal: (81) 32635<br/>
><br/>
> --<br/>
> Linux-audit mailing list<br/>
> Linux-audit@redhat.com<br/>
> <a href="https://listman.redhat.com/mailman/listinfo/linux-audit" target="_blank">https://listman.redhat.com/mailman/listinfo/linux-audit</a></div>
</div>
</div>
</div></div></body></html>