Originally posted by: SystemAdmin

I modified the .profile of a user id to start "script" when the user logs in.
When the user logs out, I have added a trap command in the .profile file to capture the exit signal.
And in that trap command, I have added the creation of a file called .logout.
And in the .logout file, I have added the command to send the test_audit file(created by script command) to the management, as an email.

Since the starting of the "script" is in the .profile of the user id what would keep someone from logging on as that user id run the ps -ef command find the "script" running in the profile and use the kill command to stop the "script" from running which would stop the tracking or logging of this data.

Also, if the session is closed without running the exit command then the logging is also not saved and emailed out ?

How to achieve the above 2 points? Can someone please guide me.
#AIX-Forum

Originally posted by: shargus

One thought might be to change the shell for userid to 'script'. That way, if someone kills it, the login exits.
#AIX-Forum

Originally posted by: SystemAdmin

One thought might be to add the script to /etc/profile rather than to the user .profile. This way the user will not see the reference as easily. To stop all users running the script, you would need an if clause. A quick thought is:

[[ `whoami` = "xxxxx" ]] && script /tmp/xxxxx.$$ > /dev/null 2>&1

You may also wish to turn on extended history all users in the /etc/profile; however, a knowledgable user will know about the .sh_history file and delete it.
#AIX-Forum