Logging administrative changes

[dirkdevos]

Yes, I am talking about PCI DSS. For PCI 3.0 there are some additional things that we need to do and I am just looking at the access to our apache servers. We have taken root access away and restricted user access to certain commands using "sudo".

What I need now is to make sure that every time that say for example the "passwd" command gets executed that it is logged and accounted for.

In short, I want to try and make sure that we have locked down the server as much as we can, log certain "activity" and verify that "activity" with the user.