topic Re: user session logs in Operating System - HP-UX

user session logs

Michael G Jaynes — Fri, 15 Aug 2008 13:28:11 GMT

Because of SOX, we are no longer able to login as user root. However, the other sys admin and I login as our usernames and then su to the root account to perform most of our work. We use a SSH terminal session to login. Is there a way to prevent the root account from logging in this manner. I wouls like to give a screenshot to the suditors to prove we are no longer logging in with the root account. They say it is okay that we su to the account. Also am looking in to the logs from user sessions and when I su to root, it logs a login, so I am not sure how to prove that we are no longer loggin in.

Re: user session logs

Aneesh Mohan — Fri, 15 Aug 2008 13:41:12 GMT

Hi,

Install SUDO software and configure the super user access to various accounts on sudo configuration file using "visudo".

Thanks,
Aneesh

Re: user session logs

candlejack — Fri, 15 Aug 2008 13:41:23 GMT

In /var/adm/syslog/syslog.log you can see who is switching users. For example, when I su to root I get an entry like this:

Aug 15 10:29:07 freddub su: + tZ matt-root

That shows that user "matt" is switching to "root," and not logging in directly.

Re: user session logs

Prashanth Waugh — Fri, 15 Aug 2008 14:10:55 GMT

Hi Michal
Check the su log the path is /var/adm/sulog
also check user history file which will be in his /home directory.

Regards
Atul

Re: user session logs

Prashanth Waugh — Fri, 15 Aug 2008 14:15:38 GMT

Hi ,

Check the /var/adm/wtmp and /var/adm/utmp
for user logs

Reagrds
Atul

Re: user session logs

Deepak Kr — Sat, 16 Aug 2008 00:32:32 GMT

Try using sudo for all sysadmin tasks for which you require root level priviledges.

Stopping root loggin whenever you switch to root id is not a good idea keeping security of box in mind.

sudo is freely available and easy to configure ...

regds...DK

Re: user session logs

Patrick Wallek — Sat, 16 Aug 2008 02:42:29 GMT

I think everyone has missed the point so far.

To disallow root from connecting via ssh you need to modify the sshd_config file and set the option 'PermitRootLogin' to NO'.

Information available here:
http://docs.hp.com/en/5992-4213/apas02.html#v1229989

(Search for PermitRootLogin. There is also a sample sshd_config file at the bottom of the page.)

Re: user session logs

George_Dodds — Sat, 16 Aug 2008 10:24:18 GMT

Patricks hit the nail on the head.

In my last role we had to implement the same thing for SOX, you might well find that an auditor will come to keep you company while you run through a set of tasks for them.

We also had to run a script they gave us which checked system security.

At least that was the case the last 3 audits i had to deal with.

Re: user session logs

Michael G Jaynes — Mon, 18 Aug 2008 14:18:38 GMT

Thanks Patrick. That is exactly what I was looking for.

Re: user session logs

Michael G Jaynes — Mon, 18 Aug 2008 14:31:18 GMT

However I do not have that file at the path specified. I have 4 of them. Is the path different if I am on HP-UX 11.23?

Re: user session logs

Patrick Wallek — Mon, 18 Aug 2008 14:36:21 GMT

My sshd_config file is in /etc/opt/ssh.

Note that there is an sshd_config and an ssh_config (without the 'd').

Details on each are available in the man pages (man ssh_config ; man sshd_config). In a nutshell ssh_config is the client config. sshd_config is the ssh daemon config file.

Re: user session logs

Michael G Jaynes — Mon, 18 Aug 2008 14:38:32 GMT

I see.
I've got
/opt/ssh/etc/sshd_config
/opt/ssh/newconfig/opt/ssh/etc/sshd_config
/opt/ssh/src/ssh/etc/sshd_config
/opt/ssh/src/ssh/sshd_config

I am about to see if I can figure out what each is. Thanks for the help.

Michael

Re: user session logs

Steven E. Protter — Mon, 18 Aug 2008 14:45:18 GMT

Shalom,

We are under SOX and still allowed to login under root. Hmmm.

http://www.hpux.ws/?p=19

That can create key exchange only root access system to system and comply with your auditors interpretation of SOX

SEP

Re: user session logs

Patrick Wallek — Mon, 18 Aug 2008 15:21:53 GMT

>>/opt/ssh/etc/sshd_config
It should be this one.

>>/opt/ssh/newconfig/opt/ssh/etc/sshd_config
This is a sample file.

>>/opt/ssh/src/ssh/etc/sshd_config
>>/opt/ssh/src/ssh/sshd_config
Did you comple from source? These appear to be part of the source code.