From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 7085 invoked from network); 28 Dec 2000 11:27:36 -0000 Received: from sunsite.dk (HELO sunsite.auc.dk) (130.225.51.30) by ns1.primenet.com.au with SMTP; 28 Dec 2000 11:27:36 -0000 Received: (qmail 25039 invoked by alias); 28 Dec 2000 11:27:07 -0000 Mailing-List: contact zsh-users-help@sunsite.auc.dk; run by ezmlm Precedence: bulk X-No-Archive: yes X-Seq: 3580 Received: (qmail 25032 invoked from network); 28 Dec 2000 11:27:07 -0000 X-Envelope-Sender-Is: Andrej.Borsenkow@mow.siemens.ru (at relayer david.siemens.de) From: "Andrej Borsenkow" To: "Vlad" Cc: Subject: RE: HOW do i.. Date: Thu, 28 Dec 2000 14:27:02 +0300 Message-ID: <000201c070c1$19b2c840$21c9ca95@mow.siemens.ru> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2911.0) In-Reply-To: Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4133.2400 > > is there a way to simultaneously log user's activity under root? > There is no zsh-internal way that cannot be overcome by user. As suggested, use tty spy programs. Besides, depending on options, not everything may be saved in history (or in wrong order). You may use preexec function to log current command, but you cannot prevent user from un- or re-defining it. See below. > > > > The most you can do is to use fc command to write *current* entries (up to > > HISTSIZE) to some file at logout. But, how can you prevent user > from modifying > > .logout, TRAPEXIT ot whatever? > > -rw-r--r-- 1 root wheel 87 Dec 26 19:42 /etc/zshrc > ??? setopt norcs unset TRAPEXIT I used wrong word, sorry. I did not mean "modifying zlogout". I meant, that user can always prevent zsh from running it, can unset/change any variable/function. -andrej