topic Re: User Commands in Operating System - HP-UX

User Commands

Nobody's Hero — Fri, 18 Jul 2008 11:46:50 GMT

I know this topic has surfaced because I remember reading about it here, however a search in the ITRC came up short.

I want to trap what commands a team member is issuing after he su's to root. I can look at history but I dont think it shows me all the commands that all sessions have been issuing. Is there a way to see what commands they issue after su'ing?

Re: User Commands

Dennis Handly — Fri, 18 Jul 2008 12:09:52 GMT

There is no real good way. If he can use su without the "-", HISTFILE can be set to nothing. He can also change anything on the system that hasn't been already sent elsewhere.
So probably sudo for each command is a way to track things.

Re: User Commands

Patrick Wallek — Fri, 18 Jul 2008 12:47:14 GMT

There is a third party product called PowerPassword that can do things similar to what you require.

It works kind of like sudo, but it does have keystroke logging capabilities.

More information on PowerPassword here:
http://www.symark.com/products/ppoverview.html

Re: User Commands

Patrick Wallek — Fri, 18 Jul 2008 12:53:32 GMT

I think I need more coffee this morning.

The product that does things similar to what you require is actually PowerBroker, NOT PowerPassword as I said above..

More info here:
http://www.symark.com/products/pboverview.html

Re: User Commands

Rasheed Tamton — Sat, 19 Jul 2008 06:49:14 GMT

Hi,
As said Powerbroker is a good tool for this. The Pbreplay of Powerbroker can be used to playback the keystroke sessions of root.

You can use the below script which would give you the last 10 lines (tail default) of the history files of the users who used su today (only today). You can just fine tune it according your needs. May be someone can fine tune more logical one based on this.

#!/sbin/sh
TDATE=" `date +'%m/%d'`"
for TUSER in `grep $TDATE /var/adm/sulog| awk ' /root$/ {print $NF}'|cut -d\- -f1|grep -v root`
do
echo ====================================
echo $TDATE
echo $TUSER
echo ====================================
tail ~$TUSER/.sh_history
echo ====================================
sleep 2
done

rgds.

Re: User Commands

Sharma Sanjeev — Mon, 21 Jul 2008 08:37:16 GMT

Hi

Keon Boks is very good for this

Regards
Sanjeev