login session transcript

["Jonathan C. Detert" <detertj () msoe edu>]

Hello,

I need to give a vendor shell access to a freeBSD system I run,
and worse yet, I need to give them root access.
I want to know everything the vendor does while logged in.

I'm thinking of making the vendor's login shell be

        'script -q -a <somefilename>'

but :

a) i don't want the vendor to be able to delete the logfile

b) it would be nice if the vendor wouldn't know his activity was being
   logged

Does anyone have a better suggestion for me than to use script?
Does anyone have an idea how to address points a) and b) ?

Thanks
-- 
Happy Landings,

Jon Detert
IT Systems Administrator, Milwaukee School of Engineering
1025 N. Broadway, Milwaukee, Wisconsin 53202