Skip to content
ghostshell
Get started

Auto-record on login

Record every interactive login automatically with the optional profile.d hook - fail-open, nested-shell aware, one file to remove.

The package installs a profile.d hook that records every interactive login and logs out when the recorded shell exits. Nothing else to configure — users just log in and work.

To enable it manually (for example after a static-binary install):

bash
sudo install -m644 scripts/profile.d/ghostshell-autorec.sh /etc/profile.d/ghostshell-autorec.sh

Behavior

  • Triggers only for interactive shells with a real TTY, and skips entirely when ghostshell is absent.
  • Skips nested shells (sudo su -, su -, subshells) two ways: an exported GHOSTSHELL_REC=1 marker the hook sets before recording (inherited by child shells, robust against process-name spoofing) and, as a fallback, detecting a ghostshell process in the ancestry.
  • Fail-open: if the recorder cannot start for any reason, a normal shell continues. A login is never blocked.

Disable

Remove the file:

bash
sudo rm /etc/profile.d/ghostshell-autorec.sh

Scope

The login hook records interactive sessions only. A non-interactive SSH command (ssh host "cmd") never sources profile.d, so it is not captured by this hook — for that, enable the opt-in sshd ForceCommand wrapper.

Warning: The hook is deliberately fail-open and can be sidestepped by a determined user with shell access. That is a design decision, not an accident: availability is prioritized over guaranteed capture. Read the integrity caveat before treating auto-record as an enforcement mechanism.

Source of truth: README on GitHub