Rootsh is a tool from which you can log your user activity in plain-text, so all the activities that are performed by the user even changing the directory to restarting the services all can be logged in.
So in this article, I will tell you how you can install and configure rootsh utility on Ubuntu 18.04 LTS and Ubuntu 16.04 LTS. Let’s get started.
We need to install the .deb file which you can find below
# wget http://debian.qcode.co.uk/debs/rootsh_1.5.4-1_amd64.deb
Install the package from the below command
# dpkg -i rootsh_1.5.4-1_amd64.deb
Next we need to create a folder in /var/log/rootsh and the directory configuration for log collection in roots
# mkdir -p /var/log/rootsh
Add the below line for shell users in linux.
# echo "/usr/local/bin/rootsh" >> /etc/shells
After that log out from your current ssh session and login again and try to run some command. Now the logs will be stored in /var/log/rootsh/