Clishtory

Alex- — Wed, 07 Dec 2022 11:27:12 GMT

The following script can be run on a Gaia system to provide a log of all Clish entries from all users.

You can also use the script repository in Smart Console.

Observations:

The Clish history file is written upon logout of the session, so if a command crashes the system it could not be logged, nor does it log commands being entered by an active user
There's no timestamps that I know of for individual commands
The script will cycle through UID and collect the Clish history from each one. Some Check Point services have UID above 102 but don't use clish, so they will still appear in the report
I'm including the base64 below to use in your favourite launcher
Only tried on R81.10

#!/bin/bash echo "Clish history for $(hostname)" printf "\n" readarray -t user_index < <(cat /etc/passwd | awk -F: '{user_id=$3+0; if(user_id==0 || user_id > 102) {print $1}}' | grep -v root) declare -p user_index >/dev/null for i in ${user_index[@]} do if test -f /home/$i/.clish_history; then echo "User $i, last modified on $(ls -l /home/$i/.clish_history | awk '{print $6, $7}')" cat /home/$i/.clish_history else echo "No clish entries for user $i" fi printf "\n" done

Base64

IyEvYmluL2Jhc2gKCmVjaG8gIkNsaXNoIGhpc3RvcnkgZm9yICQoaG9zdG5hbWUpIgpwcmludGYgIlxuIgoKcmVhZGFycmF5IC10IHVzZXJfaW5kZXggPCA8KGNhdCAvZXRjL3Bhc3N3ZCB8IGF3ayAtRjogJ3t1c2VyX2lkPSQzKzA7IGlmKHVzZXJfaWQ9PTAgfHwgdXNlcl9pZCA+IDEwMikge3ByaW50ICQxfX0nIHwgZ3JlcCAtdiByb290KQpkZWNsYXJlIC1wIHVzZXJfaW5kZXggJj4vZGV2L251bGwKCmZvciBpIGluICR7dXNlcl9pbmRleFtAXX0KZG8KaWYgdGVzdCAtZiAvaG9tZS8kaS8uY2xpc2hfaGlzdG9yeTsgdGhlbgplY2hvICJVc2VyICRpLCBsYXN0IG1vZGlmaWVkIG9uICQobHMgLWwgL2hvbWUvJGkvLmNsaXNoX2hpc3RvcnkgfCBhd2sgJ3twcmludCAkNiwgJDd9JykiCmNhdCAvaG9tZS8kaS8uY2xpc2hfaGlzdG9yeQplbHNlCmVjaG8gIk5vIGNsaXNoIGVudHJpZXMgZm9yIHVzZXIgJGkiCmZpCnByaW50ZiAiXG4iCmRvbmUK

The output will be something like this.

Clish history for <hostname> User admin, last modified on Dec 6 installer check-for-updates lock database override installer check-for-updates show installer status exit No clish entries for user postfix User <user removed>, last modified on Dec 6 show dns expert show asset networ show asset network exit User <user removed>, last modified on Dec 6 show config-lock show ntp servers exit No clish entries for user cp_postgres No clish entries for user cp_extensions No clish entries for user cpep_user

Smart Console

Re: Clishtory

PhoneBoy — Tue, 06 Dec 2022 15:39:44 GMT

Huh, I didn’t even realize we tracked clish history.
If you’re looking at auditing what users do, using the AAA functionality might be better as the commands issued are sent by syslog.

Re: Clishtory

Alex- — Wed, 07 Dec 2022 11:43:23 GMT

I believe that one of the strengths of Gaia/Titan is that everything is logged or can be set to do so.

AAA is indeed much better overall for this sort of things, this is just a simple tool for implementations that don't run it and would be interested in CLI user logs in one go.

topic Clishtory in API / CLI Discussion

Clishtory

Re: Clishtory

Re: Clishtory