How to view the changes made by a cPanel Support Analyst or Engineer via the command line

Introduction

Whenever access is granted to cPanel support through a ticket, our automated ticket system initiates an SSH session with the server. As a part of the automated process of initiating the SSH session, our system will ensure that all of the commands that an Analyst or Engineer runs will be saved to a history file of a specific name within the root user's home directory. You may use the following command to view the bash history of one of our Analysts or Engineers to see what actions were taken on your server via SSH. This can be a great way to learn more about what kinds of commands and scripts analysts use to troubleshoot issues. This can also serve as a way to audit changes if you want to know if a particular change was performed by an analyst while they were logged into your server.

Procedure

Method  #1: Viewing the Raw Bash History Files

1. Login to the server via SSH or Terminal as the root user
2. Issue the following command to list all of the bash history files for the analysts who have worked on the server:

   ls -lah /root/.bash_history.cpanel_ticket*

   NOTE: You'll notice that each history file contains the ticket ID that it is associated with in the filename.
3. Use the less command to view the file of your choice

Method  #2: Use an Awk command to format the files into a human readable format:

1. Login to the server via SSH or Terminal as the root user
2. Issue the following command to list all of the bash history files for the analysts that have worked on the server:

   ls -lah /root/.bash_history.cpanel_ticket*

   NOTE: You'll notice that each history file contains the ticket ID that it is associated with in the filename.
3. Use the following command to format the file of your choice. Be sure to replace FILENAME at  the end of the command with the history file you would like to view:

   awk -F\# '/^#1[0-9]{9}$/ { if(cmd) printf "%s %s\n",ts,cmd; ts=strftime("%F %T",$2); cmd="" } !/^#1[0-9]{9}$/ { if(cmd)cmd=cmd "\n" $0; else cmd=$0 }' FILENAME

    

Method #3  Use a script to automate the process of finding and formatting the files

1. Login to the server via SSH or Terminal as the root user
2. Create the script file with the following command:

   touch /root/cPanelBashHistoryTool.sh

3. Make the file executable:

   chmod +x /root/cPanelBashHistoryTool.sh

4. Open the file with the text editor of your choice
5. Copy the below script  into the file:

   #!/bin/bash
   
   RED='\033[0;31m'
   NC='\033[0m'
   
   echo
   find /root/ -type f -name ".bash_history.cpanel_ticket*" | grep -v "humanreadable" |
   while read histpath
   do
   echo
   ticketID=$(echo $histpath | sed 's/\/root\/.bash_history.cpanel_ticket.//')
   humanReadable="$histpath-humanreadable"
   printf "${RED}FOUND${NC}: %s\n" $histpath
   printf "${RED}TicketID${NC}: %s\n" $ticketID
   echo "Generating Human Readable Version..."
   awk -F\# '/^#1[0-9]{9}$/ { if(cmd) printf "%s %s\n",ts,cmd; ts=strftime("%F %T",$2); cmd="" } !/^#1[0-9]{9}$/ { if(cmd)cmd=cmd "\n" $0; else cmd=$0 }' $histpath > $humanReadable
   printf "${RED}HumanReadablePath${NC}: %s\n" $humanReadable
   echo "Use the following command to view the human readable version:"
   echo "less $humanReadable"
   done
   echo
   echo "Script Finshed."

    

6. Run the script and then review the output to see the paths to the human readable files that were generated:

   bash /root/cPanelBashHistoryTool.sh