net admin knows so much...

Hi,
I usually have great respect to the net admin as they seem to know
every little piece knowledge. Until recently...

I use VNC so that I can run Linux stuff on my Windows machine.
Usually when I want to kill VNC, I use "ps" command to list vncserver
ID and "kill" it. The other day the respected admin came to me and told
me, he noticed my way to close VNC, and he suggested me a cleaner way,
"vncserver -kill :1".

It works of course, but I am scared. HOW DOES HE KNOW THE WAY I DO
THIS?

If VNC does not have any speciality, which I doubt it has, so that
admin is automatically informed of how it is terminated, then for every
command I type on my keyboard, he knows?!

That does not make me comfortable.

I am curious, if you are a net admin, could you tell me this 2
things?
1) From technical point of view, how do you know my typing command?
Except that "cat .history"?

2) Do you often check out how the user is doing on the network?

Thanks.

(E-Mail Removed) wrote:
> I use VNC so that I can run Linux stuff on my Windows machine.
> Usually when I want to kill VNC, I use "ps" command to list vncserver
> ID and "kill" it. The other day the respected admin came to me and told
> me, he noticed my way to close VNC, and he suggested me a cleaner way,
> "vncserver -kill :1".
>
> It works of course, but I am scared. HOW DOES HE KNOW THE WAY I DO
> THIS?

Because when you terminate the process abnormally
that leaves trace evidence of that behind in ~/.vnc

(E-Mail Removed) wrote:
> It works of course, but I am scared. HOW DOES HE KNOW THE WAY I DO
> THIS?
>
> If VNC does not have any speciality, which I doubt it has, so that
> admin is automatically informed of how it is terminated, then for every
> command I type on my keyboard, he knows?!

There's quite a lot of possibilities. Maybe he just look at your
bash history file. Or he's using process accounting. Or maybe the
system is using grsecurity, that puts a line in the logs when a
process is killed. If he only have told you about your way of
killing the processes then it can be that he's using grsecurity
and he's seeing the lines in the logs.

> Thanks.

Regards.

--

Jose Maria Lopez Hernandez
Director Tecnico de bgSEC
(E-Mail Removed)
bgSEC Seguridad y Consultoria de Sistemas
http://www.bgsec.com
ESPAÑA

The only people for me are the mad ones -- the ones who are mad to live,
mad to talk, mad to be saved, desirous of everything at the same time,
the ones who never yawn or say a commonplace thing, but burn, burn, burn
like fabulous yellow Roman candles.
-- Jack Kerouac, "On the Road"