1$Id: PROBLEMS,v 1.2 2002/05/22 01:22:33 hbo Exp $ 2 3Sudoscript is not a perfect solution to the problem of 4maintaining an audit trail of root access. It's a compromise 5solution to that problem. 6 7One set of weaknesses has to do with the use of 8script(1). Logs produced by this standard Unix command are 9quite ugly. This is because script(1) passes all terminal 10input and output through to the typescript without any 11filtering. On the input side, this means that all control 12characters typed by the user appear in the typescript. Any 13special characters embedded in the user's prompt also show 14up. On the output side, programs like vi that use terminal 15capabilities to draw their screens will make a massive hash of 16the typescript output. 17 18The following small shell script from the Unix Power Tools 19collection uses sed to filter a typescript for common input 20control characters: 21 22 #!/bin/sh 23 # Public domain. 24 25 # Put CTRL-M in $m and CTRL-H in $b. 26 # Change \010 to \177 if you use DEL for erasing. 27 eval `echo m=M b=H | tr 'MH' '\015\010'` 28 29 exec sed "s/$m\$// 30 :x 31 s/[^$b]$b// 32 t x" $* 33 34This very simple and rudimentary script actually goes a long 35way toward making typescript logs readable, as long as the 36user doesn't type 'vi'. I considered and rejected doing 37something like this in sudoscriptd. One reason is that the 38daemon needs to service the FIFO quickly to avoid dropping 39data. But the main reason is I am reluctant to remove data 40from a security log. The upshot is you will need to 41post-process /var/log/sudoscript to get something useful from 42it. 43