Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Would it be possible to securely store all issued shell commands (.bash_history etc) in a block chain to prevent users from modifying their history?
I'd be interested in implementing this for several multi user systems, though I wonder why no one seems to have adopted this idea yet. Many attacks involving shell access, in some way or another, could be traced better if the command history was accurate; malevolent users could not cover up their actions, and so on.
The shell is probably the wrong place to do a logging of commands. A user could simply execute another shell without history or execute commands read from stdin without leaving a trace in the history. Thus it does not protect a lot against malevolent users.
Instead of securing the shell history one should securely log the commands executed by a user, no matter if these are executed by the shell or not. And this should be done so that the user is not able to execute any commands without trace. There is actually already an audit framework which can do this, see System Auditing in the RHEL documentation.
And while blockchain sounds like a nice (and hype) technology: there are other technologies which provide the necessary security without all the overhead. For logging the activity of a non-privileged user it is enough to do the logging as root. In case one fears privilege escalation one can use the existing mechanisms of syslog to log to a remote server. And some syslog implementations also provide a way to sign the messages to prove their origin.
