Auditing User Keystrokes with pam_tty_audit and Linux Auditd
Relying on standard shell history (~/.bash_history) for security auditing is fundamentally flawed: users can unset HISTFILE, launch sessions inside screen/tmux, prepend commands with spaces, or delete history files before logout. To reliably monitor user commands at the kernel level, Linux provides the pam_tty_audit PAM module. This module enables TTY input logging directly through the Linux Audit daemon (auditd), capturing keystrokes before the shell receives them. Module Parameters pam_tty_audit.so supports three key arguments: ...