Q: What is this?
A: bash RPM package for CentOS 7/x86_64 with (forced, feature cannot be turned off) history logging to syslog enabled.
Q: How does the output look like?
A: All bash comands will be logged in /var/log/messages by default:
[root@localhost steve]# tail -f /var/log/messages Jul 7 21:36:38 localhost -bash: HISTORY: PID=1268 UID=0 ip a Jul 7 21:36:44 localhost systemd: Created slice User Slice of steve. Jul 7 21:36:44 localhost systemd: Started Session 2 of user steve. Jul 7 21:36:44 localhost systemd-logind: New session 2 of user steve. Jul 7 21:36:45 localhost -bash: HISTORY: PID=1301 UID=1000 w Jul 7 21:36:45 localhost chronyd[678]: Selected source 162.159.200.123 Jul 7 21:36:46 localhost -bash: HISTORY: PID=1301 UID=1000 dmesg Jul 7 21:36:49 localhost -bash: HISTORY: PID=1301 UID=1000 sudo bash Jul 7 21:36:53 localhost bash: HISTORY: PID=1324 UID=0 tail -f /var/log/messages Jul 7 21:37:46 localhost bash: HISTORY: PID=1324 UID=0 tail -f /var/log/messages
Q: Why?
A: Surveillance, security, honeypots, etc.
Q: How to (short, insecure, do not run unsigned binaries)?
A: Just run these commands:
curl https://raw.githubusercontent.com/finchss/bash.el7/master/bash-4.2.46-34.el7.x86_64.rpm -o bash-4.2.46-34.el7.x86_64.rpm sudo rpm --force -Uiv bash-4.2.46-34.el7.x86_64.rpm echo 'exclude=bash*' >> /etc/yum.conf
OPTIONAL
If you want the logs to be in a different file:
cat > /etc/rsyslog.d/hist.conf << EOF :msg, contains, "HISTORY" USER.INFO /var/log/history :msg, contains, "HISTORY" USER.INFO ~ EOF service rsyslog restart
If you want the logs to be in a different file and a remote syslog (UDP) host (replace 172.16.136.1 with your syslog server ip):
cat > /etc/rsyslog.d/hist.conf << EOF :msg, contains, "HISTORY" user.info /var/log/history :msg, contains, "HISTORY" user.info @172.16.136.1:514 :msg, contains, "HISTORY" ~ EOF service rsyslog restart
and for even more logging options:
cat >> /etc/bashrc << EOF export HISTTIMEFORMAT="%d/%m/%y %T " export HISTSIZE=100000 export HISTFILESIZE=100000 export PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" readonly HISTFILE readonly HISTSIZE readonly HISTFILESIZE readonly HISTTIMEFORMAT EOF