topic Re: Keylogger for specific users in Operating System - HP-UX

Keylogger for specific users

Brahnda Eleazar — Wed, 22 Aug 2007 08:09:59 GMT

Peace all,

Is there any way or a tool in HP-UX (11.11 and 11.23) that can keylog for specific users only?

Thanks,
=adley=

Re: Keylogger for specific users

Steven E. Protter — Wed, 22 Aug 2007 08:19:24 GMT

Shalom,

Sure, don't set HISTFILE and HISTSIZE in /etc/profile, set it in the users .profile file.

SEP

Re: Keylogger for specific users

Brahnda Eleazar — Wed, 22 Aug 2007 20:35:16 GMT

Peace Steven,

Actually, my boss' idea was something like this:
If root logs in via console, the keylogger should be executed to record all root's actions (well, enlarging the history file size can do this as well).

But, whenever a non-root su to root, then it must also be keylogged (only when it acts as root). In other words, bind to its tty. Comparing sulog and the history file can achieve audit to a certain extent, but my boss wants a nicer way to do things.

Last of all, the logs of the keylogger would then be send regularly to another box.

Thanks,
=adley=

Re: Keylogger for specific users

Dennis Handly — Thu, 23 Aug 2007 04:11:14 GMT

>whenever a non-root su to root,

I'm sure if you search the forum, there will be suggestions on not allowing this and instead use sudo to do each command, which then can be logged and which commands/users can be tailored.

Re: Keylogger for specific users

whiteknight — Thu, 23 Aug 2007 11:36:57 GMT

Brahnda,

Seems your boss is concern on system security.

check this out on 11.23 HPUX security containment address your boss concern

http://h20293.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=SecurityExt

WK

please assign points

Re: Keylogger for specific users

whiteknight — Thu, 23 Aug 2007 12:18:43 GMT

Brahnda,

Another points.

Log Consolidation Overview
http://docs.hp.com/en/T2786-90090/ch03s02.html

WK
please assign points

Re: Keylogger for specific users

Brahnda Eleazar — Sun, 02 Sep 2007 21:10:38 GMT

Peace all,

Sorry for the late reply.
I was sick and just got better.

Let me look at the links first.

Thanks,
=adley=

Re: Keylogger for specific users

Patrick Wallek — Sun, 02 Sep 2007 21:23:50 GMT

There is a commercial product called Power Broker that can do keystroke logging.

It can also control who has access to root.

Information on Power Broker available here:
http://www.symark.com/powerbroker.htm