mikrotik_snippets/linux/snoopy.txt

41 lines
1.0 KiB
Plaintext
Raw Normal View History

2017-08-24 22:15:18 +03:00
### Compile snoopy in Debian.
2017-10-02 13:47:49 +03:00
snoopy: log all commands executed by all users.
2017-08-24 22:15:18 +03:00
* Install
apt-get install dh-autoreconf socat git
* Clone
git clone https://github.com/a2o/snoopy.git
* Edit lib/inih/src/ini.h
INI_MAX_LINE --> 512
* Compile
./bootstrap.sh
./configure
make
* As root, install
make install
* Files installed
/usr/local/etc/snoopy.ini
/usr/local/lib/libsnoopy.la
/usr/local/lib/libsnoopy.so.0.0.0
/usr/local/sbin/snoopy-disable
/usr/local/sbin/snoopy-enable
* Edit /usr/local/etc/snoopy.ini
message_format = "SNOOPY HST=%{hostname} DAT=%{datetime} TIM=%{timestamp}.%{timestamp_ms} USR=%{tty_username} USR=%{username} UID=%{tty_uid} UID=%{uid} LOG=%{login} EUSR=%{eusername} EUID=%{euid} GRP=%{group} GID=%{gid} EGID=%{egid} EGRP=%{egroup} TTY=%{tty} SSH=%{env:SSH_CONNECTION} CWD=%{cwd} FIL=%{filename} CMD=%{cmdline}"
filter_chain = "exclude_spawns_of:cron"
output = devlog
error_logging = no
* Enable
snoopy-enable
* Reboot
2017-08-24 22:17:02 +03:00
* Logs by default
/var/log/auth.log