key_filter.4 (2012 03)

k
key_filter(4) key_filter(4)
NAME
key_filter - configuration file for RBAC keystroke logging feature
SYNOPSIS
/etc/rbac/key_filter
DESCRIPTION
The /etc/rbac/key_filter
file is the configuration file for the keystroke logging feature described
in keystroke (5). For a login session, standard input (stdin) and the corresponding standard output
(stdout) and standard error (stderr) can be logged into a session specific keystroke logfile, depending on
how
/etc/rbac/key_filter
is configured. For details on how an authorized user can modify the
/etc/rbac/key_filter
file to create a customized keystroke logging policy, see keystroke (5)
CONFIGURATION FILE SYNTAX
Lines whose first non-whitespace character is a hash sign (#) are treated as comments and are ignored.
The
/etc/rbac/key_filter
file can include any number of entries, including none. Each entry is
specified on a single line and can contain the strings
ks_all or ks_stdin, or can be a valid user,
group, or role entry in the format described below.
If a single line with the string
ks_all is specified, then all terminal input and output for all users are
logged. If the string
ks_stdin is specified instead, then all terminal input for all users is logged but not
the corresponding output. In both cases, any subsequent lines in
/etc/rbac/key_filter are
ignored.
The
ks_all or ks_stdin string must be specified on the first non-commented line in
/etc/rbac/key_filter
in order to take effect. Otherwise, those lines are considered invalid and are
ignored. Only lines with the following syntax are considered valid:
Name:PatternTrigger:BackwardCount:ForwardCount:Filestream
where each field is as follows:
Name Name can be one of the following:
user_name The name of a user.
&group_name A UNIX group name that corresponds to the name of a user’s primary group.
The name must be preceded by an ampersand (&) to distinguish it from a user
and role name. The group name is not interpreted as a secondary group name,
only as a primary group name.
$rolename A role name defined in the /etc/rbac/roles
file. The name must be pre-
ceded by a dollar sign (
$) to distinguish it from a user and group name.
PatternTrigger
An extended regular expression (ERE) as described in regexp (5). Keystroke logging is trig-
gered for the user(s) associated with this entry when this ERE matches a line of user input in a
login session. An entry with an invalid ERE is ignored.
Note: If the field is set to a single star (*) character, then the star character is not treated as a
regular expression, but instead indicates that a user’s entire session will be logged. Keystroke
logging is triggered immediately if this field is only set to the star (*) character. For all other
cases, the star character is interpreted as a special regular expression character as described
in regexp (5).
BackwardCount
The maximum number of characters of standard input that are logged and appear immediately
before the line of input that triggered keystroke logging.
If a value of
dflt is specified, the keystroke module logs up to 1024 characters preceding the
line of input that triggered keystroke logging. The maximum value supported is 10K.
Note: The
KEY_STROKE_MAX_OUTPUT_SAVED parameter in /etc/rbac/rbac.conf,
not the BackwardCount field, restricts how many standard output and standard error char-
acters can be logged per line of input that preceded the line of input that triggered keystroke
logging.
ForwardCount
The maximum number of characters of standard input that are logged and appear immediately
HP-UX 11i Version 3: March 2012 − 1 − Hewlett-Packard Company 1