topic Re: Monitoring users in Operating System - HP-UX

Monitoring users

Jose Luis — Wed, 26 Jun 2002 15:23:22 GMT

Hello!
I have a question:
How can I know the commands executed for the users in the system (HP-UX 11.0)?
For example, in the case of the miss of a file, how can I know, who was erase it, or change the permission of a file?
Exist an application or procedure for lookin for this activity in the system?
Thank's in advance

Re: Monitoring users

Justo Exposito — Wed, 26 Jun 2002 15:31:28 GMT

Hi Jose Luis,

What about .history file?

Regards,

Justo.

Re: Monitoring users

Arockia Jegan — Wed, 26 Jun 2002 15:32:45 GMT

By looking at their history files (.sh_history) you can find out who has done changes in the file. But there are some smart users who modify the history files if they have done some mistakes. Avoiding the generic user accounts and giving proper permissions to the files/users will help you to figure out who(some time a list of users) might have changes the files.

Re: Monitoring users

steven Burgess_2 — Wed, 26 Jun 2002 15:35:28 GMT

Jose

You have the .sh_history file for each user in their home directories

There are 2 variables in /etc/profile which can control this file

HISTFILE : Contains the name of the history file
HISTSIZE : Shows how many commands are kept in the history file

Re: Monitoring users

Victor_5 — Wed, 26 Jun 2002 15:38:20 GMT

You can check .sh_history under every user's home directory.

Re: Monitoring users

S.K. Chan — Wed, 26 Jun 2002 15:41:28 GMT

The .sh_history in the user's hoem directory is usually the way to check but that doesn't mean the user cannot modify or delete any traces from that file.

Re: Monitoring users

Holger Knoppik — Thu, 27 Jun 2002 11:05:24 GMT

Hi Jose,

another suggestion:
Make the script command work for you! You can put it into the users profile, for example:
---snip---
script -a /var/adm/users/user1.log
---snip---

NOTE that only the script command is terminated when the user types exit. But you kann kill the PPID of his shell.

HTH

RGDS, Holger

Re: Monitoring users

George Abraham_1 — Thu, 27 Jun 2002 11:08:35 GMT

hai

put a line in cron such that it will start a script each time a user logs in.. the script file will have all the commands and their output logged in...

keep smiling
george

Re: Monitoring users

Ceesjan van Hattum — Thu, 27 Jun 2002 11:17:49 GMT

In reaction to Holker Knoppik, you should not set it into the userprofile, but in the /etc/profile, which is executed as well and should not be editable for users.

Regards,
Ceesjan

Re: Monitoring users

Holger Knoppik — Thu, 27 Jun 2002 11:31:30 GMT

Hi Ceesjan,

i should have known this ! OK, by default the user's .profile has permissions r--r--r--. The owner is the user himself. How about a chown root:sys to the .profile ? I would check that the script command does not run for root.

Just by the way ;-)

RGDS, Holger

Re: Monitoring users

Martin Johnson — Thu, 27 Jun 2002 14:09:26 GMT

You may want to look into accounting to audit some activity.

HTH
Marty