4 ms·
>It should give you a full history of all commands entered. Commands entered by that user, in a shell, assuming the shell's history file wasn't cleared. So ma
by ben1040 13y ago
>It should give you a full history of all commands entered.
Commands entered by that user, in a shell, assuming the shell's history file wasn't cleared. So maybe you'd get a history of what someone did if they sat down at your computer and typed things while you were away refilling your coffee.
Your shell history isn't going to show a trace if someone actually remotely roots your computer and starts executing commands.
- kunai 13y agoIf it was done through a root account, then sudo su and accessing a shell history should do the trick, right? Please correct me if I'm wrong.
- ben1040 13y agoIt would IF they obtained a root shell and started typing commands into it like they were at the console, and that they didn't just go ahead and delete the history file right afterwards. But if someone's used a privilege escalation method on some vulnerable software and injects code that makes system() calls as the root user, that's not going to show up in root's shell history. Shell history is just a convenience for the user typing things in the shell; it doesn't log everything that goes on in the box as that given user, and isn't an audit trail.