jailshell or not to shell

[matzah]

OK, is there any way to track what users are doing when they are in 'jailshell'?

I have one client using it and sucking up too many resources and I am curious what they are trying to run

[Ron]

You could log in and look at their
.bash_history
file.

Most recent is at the bottom.

[matzah]

Thanks, that was it... but for my own sanity, everything looks OK

But the bummer, no time/date stamps. My firewall reports excessive CPU usage, but nothing in the log appears to be doing anything more than I can/would do as a user

[Gwaihir]

Doubt it provides a truly reliable log anyway. I occasionally delete that file as part of general housekeeping. As I can do that, I assume any user can freely manipulate his / her own .bash_history.

[matzah]

The file is actually a good start and is letting me know whats going on, as the user does not appear to be hiding anything... better than nothing at all

[Spathiphyllum]

...I occasionally delete that file [bash_history] as part of general housekeeping...

How often do you do this?

[Gwaihir]

Not often. Perhaps once a year or so.

I just wanted to point out that one can do that, i.e. that the file can be helpful, but isn't in any way secured.

[Vin DSL]

Not often. Perhaps once a year or so...

Can't say I've ever actually deleted it, but I DO edit it from time-to-time (once a year or so) to get rid of the cruft...

It's sort of an archive of my brilliance!