topic Re: SU / logging in Operating System - HP-UX

SU / logging

Nobody's Hero — Thu, 20 Apr 2006 12:13:13 GMT

When a user logs in as themselves, that is a personal user account, we make them 'su' to oracle or other special user accounts. Problem is , when they su to oracle or other accounts, they end up getting reported as a dormant account because they have not logged onto the system in 'x' amount of days. Anyone know why this is happening? The audit keeps hitting oracle and other accounts as 'dormant'.

Do accounts not show up in the last log if they are initiated by 'su' ???

Re: SU / logging

James R. Ferguson — Thu, 20 Apr 2006 12:19:47 GMT

Hi Robert:

No, 'su' activity is not logged in '/var/adm/wtmp'. Rather, the switch is shown in '/var/adm/sulog'. This makes "sense" since to perform a (s)witch-(u)ser you must already be logged on.

You can tell the success (+) or failure (-) from the 'sulog' with the positive/negative notation recorded for the action.

Regards!

...JRF...

Re: SU / logging

Jeff_Traigle — Thu, 20 Apr 2006 12:23:02 GMT

Welcome to the wonderful world of account access logging. It's a mess. As you've discovered, su logins are not recorded in wtmp so will not show up in last's output. The only place such logins are recorded in sulog and/or syslog, depending on the configuration.

Re: SU / logging

Steven E. Protter — Thu, 20 Apr 2006 13:16:39 GMT

Shalom Robert,

Seems reasonable that with last -R output and the sulog you can write a short awk script and have a very good idea what is going on.

oracle and other accounts may be dormant if the dba's never log on. Your startup scripts will only leave evidence in the sulog.

su - oracle -c run by root. Did Orale log in? not as afar as wtmp is concerned.

SEP

Re: SU / logging

Tom Henning — Fri, 21 Apr 2006 05:36:47 GMT

If this is a trusted system it might be better to write a script to run through the users doing a getprpw on each user. The slogint field will reflect a sucessful login date event for a su. Of course, this means that root has to be the one to be getting the login dates for the auditors, but at least this can refute the "dormant account" claim.