Practical UNIX and Internet Security, 3rd Edition

Unix Forensics

Although not obvious, there is a collection of other files that can be helpful in analyzing when something untoward has happened on your system. While not real log files as such, these files can be treated as possible sources of information on user behavior.

Shell History

Many of the standard user command shells, including bash, csh, tcsh, and ksh, can keep a history file . When the user issues commands, the text of each command and its arguments are stored in the history file for later re-execution. If you are trying to recreate activity performed on an account, possibly by some intruder, the contents of this file can be quite helpful when coupled with system log information. You must check the modification time on the file to be sure that it was in use during the time the suspicious activity occurred. If it was created and modified during the intruder’s activities, you should be able to determine the commands run, the programs compiled, and sometimes even the names of remote accounts or machines that might also be involved in the incident. Be sure of your target, however, because this is potentially a violation of privacy for the real user of this account.

Obviously, an aware intruder will delete the file before logging out. Thus, this mechanism may be of limited utility. However, there are two ways to increase your opportunity to get a useful file. The first way is to force the logout of the suspected intruder, perhaps by using a signal or shutting down ...