topic Re: users auditing- require tool or Script in Operating System - HP-UX

users auditing- require tool or Script

vas_3 — Mon, 12 May 2008 06:05:58 GMT

Hi all,

We have small business requirement.Requirement is: we need to audit all the commands (user/root realted ) typed by the users(only 6 users) on all hp,linux and solaris servers.

If u have any script please share with me or you know any tool, send me the tool name..

Thanks in advance...
Regards,
Sri.

Re: users auditing- require tool or Script

Steven E. Protter — Mon, 12 May 2008 07:16:39 GMT

Shalom,

Unix has a built in auditing tool. Keyboard history. It does not include a time/date stamp.

In the user profile.

HISTSIZE=5000
HISTFILE=.sh_history
export HISTSIZE HISTFILE

The log will be kept. Don't put the .sh_history file on NFS for HP-UX.

Linux uses .bash_history

I have no idea about Solaris.

SEP

Re: users auditing- require tool or Script

Dennis Handly — Mon, 12 May 2008 08:43:20 GMT

Are your users working for or against you?

You could also use typescript(1) to log all input and output.

Re: users auditing- require tool or Script

rmueller58 — Tue, 13 May 2008 02:36:23 GMT

typescript is one what to do it as well.

I used typescript to monitor a vendor account to track what they did when they were on our systems.

on sun you would use

script

check out link here:
http://ultra.pr.erau.edu/~jaffem/classes/cs125/script.htm

Re: users auditing- require tool or Script

Rasheed Tamton — Tue, 13 May 2008 10:29:43 GMT

Hi,

In HP-UX also it is script command:

script srifile (create a file called srifile and save everything printed on the user's screen into it)

script -a srifile (will append on the file)

The other way as SEP said, rely on history file. There are other tools like powerbroker, etc. which can playback (pbreplay) the logged sessions but needs to pay for that.

Regards.

Re: users auditing- require tool or Script

Dennis Handly — Wed, 14 May 2008 10:00:00 GMT

>ME: You could also use typescript(1) to log all input and output.

Oops, the default output file is typescript and the command is script(1):
http://docs.hp.com/en/B2355-60130/script.1.html