1

How can I watch another user's shell session? I'd like to evaluate another user's behavior. I'm looking into using screen, but I don't know how to force his terminal to start a screen session.

Is there a way?

Wesley
  • 32,690
  • 9
  • 82
  • 117
Rob
  • 2,393
  • 9
  • 33
  • 52

2 Answers2

3

You can set screen as the login shell for the user with 

  usermod -s /usr/bin/screen guest

Logging can be set in /etc/screenrc

Dima Chubarov
  • 2,316
  • 1
  • 17
  • 28
  • Will that only take effect when he logs in? Because he's already logged in, and I don't want to log him out thus disrupt his work, I just want to make sure he's not being naughty. – Rob Apr 29 '12 at 18:39
  • If a user has logged in, monitoring possibilities would vary even if everything she is doing is legitimate. You might look at shell history after she logs off, but if she runs a different shell or midnight commander, you would have to trace relevant history files as well. – Dima Chubarov Apr 29 '12 at 18:45
  • A key logger of some sort might be of help. – Dima Chubarov Apr 29 '12 at 19:25
2

You can try tailing the users bash history if you don't want to make them log off.

Log in, and run tail -f /home/<username>/.bash_history.

Joseph Kern
  • 9,899
  • 4
  • 32
  • 56