topic Re: Catching users ! in Operating System - HP-UX

Catching users !

Simon R Wootton — Thu, 27 Nov 2003 09:47:15 GMT

I have a situation with one of my users where I believe they are logging in using a different user id to gain greater access to our systems. I really need to see historically where particular users were logged in (using IP address) at a point in time. The 'last' command doesn't seem to give me the IP address where the user was logged in, is there any way I can match an IP address with a user historically ?? I realise it's a long shot but it would be really useful !

Does wtmp hold any valuable info ?

All help rewarded !!!

Thankyou
Simon

Re: Catching users !

Jean-Luc Oudart — Thu, 27 Nov 2003 09:49:36 GMT

if you use last -R yuo will get the IP@

man last

Rgds,
Jean-Luc

Re: Catching users !

Chris Wilshaw — Thu, 27 Nov 2003 09:54:50 GMT

As an extra note to the above reply, tracking back to an IP address may not prove anything if the address is part of a DHCP pool.

If you use static addresses, you should be OK though (unless your users are smart enough to change their IP address too before logging in).

Re: Catching users !

Bill Hassell — Thu, 27 Nov 2003 09:56:15 GMT

This sounds fairly serious so you may need to take drastic actions once you discover the abusers. I would start by changing the password on the compromised login acctounts, notifying the real owner of the account to never share a password and depending on your company's security policy (you do have one don't you?) have appropriate disciplinary action take place. And I would hope that you do NOT have multiple UID=0 accounts on your system! This is the first place that a hacker will try to attack your system. If you need assistance from other users to perform certain sysadmin tasks as root, get a copy of sudo and never give out the root password.

Re: Catching users !

Jean-Luc Oudart — Thu, 27 Nov 2003 09:58:44 GMT

On Chris comments,
It would depend on your "lease" policy for DHCP and how far back in time you want to track the suer IP@

Rgds,
Jean-Luc

Re: Catching users !

Keith Bevan_1 — Thu, 27 Nov 2003 11:44:15 GMT

Simon,

Lock,disable or password change the account in question.

See who complains ! Only the owner of the account will shout, and they should be educated about login/password confidentiality.

Next have a look back at last -R for previous and current logged users and ip address details. Its a guide but not a fool-proof way of tracking the originator/source

Keith