Miscellany

Add support for logging bash commands via syslog().
Useful for deploying in honeypot environments.

http://bugs.gentoo.org/show_bug.cgi?id=91327
http://www.nardware.co.uk/Security/html/bashlogger.htm

--- bashhist.c
+++ bashhist.c
@@ -698,7 +698,7 @@
      char *line;
 {
   hist_last_line_added = 1;
-  add_history (line);
+  add_history (line, 1);
   history_lines_this_session++;
 }

--- lib/readline/histexpand.c
+++ lib/readline/histexpand.c
@@ -1220,9 +1220,7 @@

   if (only_printing)
     {
-#if 0
-      add_history (result);
-#endif
+      add_history (result, 1);
       return (2);
     }

--- lib/readline/history.c
+++ lib/readline/history.c
@@ -31,6 +31,8 @@

 #include <stdio.h>

+#include <syslog.h>
+
 #if defined (HAVE_STDLIB_H)
 #  include <stdlib.h>
 #else
@@ -246,10 +250,24 @@
 /* Place STRING at the end of the history list.  The data field
    is  set to NULL. */
 void
-add_history (string)
-     const char *string;
+add_history (string, logme)
+     const char *string;
+     int logme; /* 0 means no sending history to syslog */
 {
   HIST_ENTRY *temp;
+  if (logme) {
+    if (strlen(string)<600) {
+      syslog(LOG_LOCAL5 | LOG_INFO, "HISTORY: PID=%d UID=%d %s",
+        getpid(), getuid(), string);
+    }
+    else {
+      char trunc[600];
+      strncpy(trunc,string,sizeof(trunc));
+      trunc[sizeof(trunc)-1]='\0';
+      syslog(LOG_LOCAL5 | LOG_INFO, "HISTORY: PID=%d UID=%d %s(++TRUNC)",
+          getpid(), getuid(), trunc);
+    }
+  }

   if (history_stifled && (history_length == history_max_entries))
     {
--- lib/readline/history.h
+++ lib/readline/history.h
@@ -80,7 +80,7 @@

 /* Place STRING at the end of the history list.
    The associated data field (if any) is set to NULL. */
-extern void add_history PARAMS((const char *));
+extern void add_history PARAMS((const char *, int ));

 /* Change the timestamp associated with the most recent history entry to
    STRING. */

--- histfile.c.orig     2007-10-20 18:29:11.000000000 -0500
+++ histfile.c  2007-10-20 18:30:04.000000000 -0500
@@ -262,7 +262,7 @@
          {
            if (HIST_TIMESTAMP_START(line_start) == 0)
              {
-               add_history (line_start);
+               add_history (line_start,0);
                if (last_ts)
                  {
                    add_history_time (last_ts);