Recommend Keylogger for Ubuntu?

Question

I purchased a new laptop recently, and I'm working on hardening it. Specifically, I'm interested in increasing my chances of recovering the machine in the event that it's ever stolen. The system runs Ubuntu 11.04 (Natty).

I've installed Prey on the machine, of course. I've also created a guest account that requires no password to log in, to give a would-be thief an opportunity to log into the machine so I can track him with Prey. (I've got some other pretty rad countermeasures on there too.) The last thing I want to get on there is a solid keylogger.

Does anyone have any keylogger experience? I've Googled around and know that there are options, but I was hoping to benefit from the community's expertise on the issue. Some options seem to have disappeared from the Canonical repositories recently (I was looking at lkl in particular), and I'm not clear what the current leaders are.

Do you have any recommendations as to which is the current "premier" Ubuntu Keylogger?

For what it's worth, this whole venture was inspired by the fantastic "Pwned by the Owner" talk from Defcon 18. It definitely warrants a watch if you've never seen it before.

http://www.youtube.com/watch?v=U4oB28ksiIo

Thanks, everyone.

Answer 1

I would go with LKL myself, but that is very subjective - others will prefer something else, I'm sure.

It doesn't matter whether or not it is in a repository, in fact I would want to build something like that myself from source.

There is of course a risk with having a keylogger installed - it could be used against you!

Answer 2

I'm interested in increasing my chances of recovering the machine in the event that it's ever stolen.

I like Rory's answer. However, I think there are three risks involved here: the risk of loosing your hardware, and the risk of loosing your data, and the risk of your private data being exposed. Solutions which attempt to recover the machine are only solving one risk.

The risk of data loss can be mitigated by a good data backup system.

The risk of data exposure may be mitigate by good data protection: proper access controls, solid encryption, and good keys or passwords. The risk of data exposure may also be mitigate by destruction: remote wiping, conditional wiping, timed expiration. The final risk is the loss of your hardware.

When you have risk there are three options: mitigate the risk, assume the risk, and transfer the risk. You have already though of some way to mitigate the risk of theft. However you havn't covered a few of the most effective, which tend to be operation rather than technical.

Never leave your laptop unattended. If a thief has no opportunit they can not steal your laptop.

When you are not using your laptop store it securely. At least use a locking cable attached to something unmovable. Or keep it in a locked drawer or cabinet. If you are not in a familiar place you can lock it in the trunk of your car.

Mark your laptop with your name in a way that is difficult to remove. You can have it etched into the case, or failing that large letters in permanant marker. It makes it harder for a thief to sell Chris's laptop, and if you put contact information as well it will help get it returned if you loose it.

Another way to deal with risk is assuming the risk, but I don't recommend doing that.

The final way to deal with risk is to transfer it. This is usually done by buying insurance. You can buy laptop theft insurance to cover the value of your laptop. If this is a personal laptop and you have homeowners insurance you may already be covered under personal property, or you may be able to add coverage to an existing policy for a small fee. I don't know insurance very well but I think renters insurance may act similarly to homeowners insurance. In any case you can check with your insurance agent.