topic Re: Track User sessions in Operating System - HP-UX

Track User sessions

joe_91 — Wed, 30 Nov 2005 09:43:50 GMT

Can someone tell me how to track user sessions? for example i would like to track all the users who have come into the hp-ux box thru telnet, rlogin etc.. Please help.

Thanks

Joe

Re: Track User sessions

James R. Ferguson — Wed, 30 Nov 2005 09:50:14 GMT

Hi Joe:

Use 'last'. See the man pages for more information. 'last' uses '/var/adm/wtmp'. IF it is not present, create it by 'touch'ing it. It will grow without bound and will need to be nulled or trimmed.

If there is nothing you want preserved, do:

# cat /dev/null > /var/adm/wtmp

If you want to preserve some contents, you must convert the binary file to an ASCII file; edit (delete) what you don't want; and convert the ASCII file back to the binary format:

# /usr/sbin/acct/fwtmp < /var/adm/wtmp > /tmp/wtmp

...edit...

# /usr/sbin/acct/fwtmp -ic < /tmp/wtmp > /var/adm/wtmp

You can do the same for the 'btmp' data.

Regards!

...JRF...

Re: Track User sessions

DCE — Wed, 30 Nov 2005 10:08:11 GMT

Joe,

If you want greater detail/tracking ability other than that supplied by last, you will need to turn on auditing (assuming your system(s) are in trusted mode)

Dave

Re: Track User sessions

Steven E. Protter — Wed, 30 Nov 2005 10:15:39 GMT

Shalom Joe,

inetd -l

Enhances logging.

tail -f /var/adm/syslog/syslog.log

You will see all relavent activity including source IP address as it happens.

the /var/adm/wtmp and /var/adm/btmp databases provide a record of this activity without the other aspects of syslog.

They are binary files and can accessed via the last and lastb commands respectively.

SEP

Re: Track User sessions

Raj D. — Wed, 30 Nov 2005 10:18:15 GMT

Hi joe ,

You can put script command in users .profile. And entire user activity will be logged.

check details with # man script

Cheers,
Raj.

Re: Track User sessions

joe_91 — Wed, 30 Nov 2005 10:23:47 GMT

JRF/SEP:

Thanks. What i was looking for was the ability to track users based on the way they have logged into the system. For example..i would want to list all users who have come into the box using telnet, similarly rlogin. if i have a particular uses session thren i need to know whether that particular user has come into the box using telnet or rlogin etc. is there a way to do it?

Thanks

Joe

Re: Track User sessions

James R. Ferguson — Wed, 30 Nov 2005 10:36:15 GMT

Hi Joe:

Look at the output of 'last'. It *will* show variously terminal origin (e.g. pts/ta), or 'ftp', 'remshd'.

You can also get the connection point (e.g. hostname or IPaddress) by adding the '-R' switch:

# last -R

Regards!

...JRF...

Re: Track User sessions

Raj D. — Wed, 30 Nov 2005 14:10:29 GMT

Hi joe ,

The answer is last command. (logs takes from /var/adm/wtmp)
Check with last command to find out if particular user has come to the box using telnet or rlogin or ftp etc.

Check for 10 times, latest login of a user :

# last -R username | head -n 10

pts/1
pts/2 etc.. are through ssh , rlogin .

pts/ta is through telnet

remshd : is throgh remote shell server.

ftp : through ftp login.

Cheers,
Raj.

Re: Track User sessions

Cem Tugrul — Thu, 01 Dec 2005 02:11:20 GMT

Joe,
As an addition to other replies
try to visit the links below;
http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=109749
http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=218820

Good Luck,

Re: Track User sessions

Muthukumar_5 — Thu, 01 Dec 2005 02:44:14 GMT

You can use last -R to get r* commands login and terminal logings also.

To specifically track telnet based login and rlogin then,

Using /etc/profile setting,

# Track User Sessions - Joe
USERLOG=/var/adm/telnet_rlogin.log
ps | grep -q 'telnet'

if [[ ${?} -eq 0 ]]
then
echo "$(who -m) $(date) telnet session" >> ${USERLOG}
fi

ps | grep -q 'rlogin'

if [[ ${?} -eq 0 ]]
then
echo "$(who -m) $(date) rlogin session" >> ${USERLOG}
fi

save the file and audit with that /var/adm/telnet_rlogin.log file.

It will do it.

Re: Track User sessions

joe_91 — Thu, 01 Dec 2005 08:31:01 GMT

Thanks all

Joe