topic Re: remsh command logging in Operating System - HP-UX

remsh command logging

Youlette Etienne_2 — Mon, 26 Nov 2001 21:36:37 GMT

Hello everyone,

Is there a way to log what commands were executed using remsh on the remote host? They do not appear in the syslog.log or the .sh_history (of the remote user) files on the remote host. There is no option in the man pages.

Thanks

Youlette

Re: remsh command logging

someone_4 — Mon, 26 Nov 2001 21:53:17 GMT

I might be wrong but I dont think there is a log that stores the commands. If you are running a script then you know the commands that are being ran. But if someone is doing just remsh -l it does not anywhere. It does log in the client in the wtmp file though. Lets see what others say.

Richard

Re: remsh command logging

harry d brown jr — Mon, 26 Nov 2001 22:17:44 GMT

You would need to log "inetd", by starting it with the "-l" option. And it will log like a madman!

Your best bet is to make sure you have a secure server by trying some of the topics brought up in this document:

http://people.hp.se/stevesk/bastion.html

live free or die
harry

Re: remsh command logging

S.K. Chan — Mon, 26 Nov 2001 22:28:05 GMT

I don't think you can log any commands executed by a remsh. Remsh gives minimal env where only PATH, LOGNAME, SHELL, HOME, PWD, and TZ variables are set. The user environment actually becomes that of the running inetd.

Re: remsh command logging

Roger Baptiste — Mon, 26 Nov 2001 22:29:11 GMT

hi,

You can run inetd with the logging turned on
#inetd -k ; inetd -l

But, this will log only the
connection details or remsh/rlogin and not the commands being run through them. For eg:
Moonlight inetd[26034]: shell/tcp: Connection from Venus on ....
-> tells a user from venus system had run a remsh command into moonlight system.

Regarding what command was run, you can only note it from the remote system user''s history file; (unless the user had not deleted it).

Please note that Remote services are Trusted services i.e it is an equivalent user existing on another system!. So, it is a sort of open invitation. You cannot give remote rights and at the same time expect to have a tight leash on the activities.

If you are not comfortable with this, go for secure shell services. But, even here i am not sure whether you willget a logging facility. Need to check it up.

HTH
raj

Re: remsh command logging

Michael Tully — Tue, 27 Nov 2001 00:15:28 GMT

Hi,

I would seriously consider turning it
off if is causing problems.

Edit /etc/inetd.conf
#shell stream tcp nowait root /usr/lbin/remshd remshd

# inetd -c (re-read the config)

I would try to aviod turning on the inetd
logging, as you will need to hire someone
to read them.

-Michael

Re: remsh command logging

Ian Dennison_1 — Tue, 27 Nov 2001 11:46:14 GMT

The 'script' command will track all actions on the initiating server when performing an 'rlogin' to another server. Worth using this, or putting a script command in the .login or .profile of the remshell user?

Share and enjoy! Ian

Re: remsh command logging

Steven Gillard_2 — Tue, 27 Nov 2001 12:05:06 GMT

Try downloading inetutils from GNU. Theres a remshd server included which I believe uses syslog to log commands.

Regards,
Steve

Re: remsh command logging

Youlette Etienne_2 — Sun, 27 Jan 2002 23:31:01 GMT

Hello everyone,

I apologize for taking such a long time to assign points but I have been encountering problems accessing the forums from work and haven't even been able to search the forums or post any additional questions or assign points since November. I'm actually posting this from home. It is extremely frustrating when I need to get information.

The problem is that I keep getting debugging error messages when accessing the forums. I believe it is error number 104, though I cannot remember at this moment. Sometimes the entire page does not load, sometimes I get the "page cannot be displayed" error message, and now with the new network installation of eprizm, I get, "URL returned zero length page". I have deleted temporary internet files but this doesn't work. I use internet explorer 5.5 at work, which worked fine until last November. So far I have not encountered these problems from home and per HP, no one else is encountering these problems.

Any help will be most appreciated.

Thanks.