topic Re: UNIX Shell Logging in Operating System - HP-UX

UNIX Shell Logging

Johnny2009 — Tue, 21 Jul 2009 09:27:53 GMT

Hi,

Can someone recommend a product that would allow me to log details of users shell sessions? A bit like an expanded .sh_history file with timestamps for each command, & also details of commands entered in sessions with databases & other tools launched from the shell.

TIA

Johnny

Re: UNIX Shell Logging

Suraj K Sankari — Tue, 21 Jul 2009 10:00:22 GMT

Hi,

Enable auditing into your server...

Suraj

Re: UNIX Shell Logging

Ganesan R — Tue, 21 Jul 2009 10:02:37 GMT

Hi Jhonny,

Then you should go for auditing enabled.

Refer these links for more details

http://docs.hp.com/en/5992-3387/ch10.html

http://docs.hp.com/en/B2355-90121/index.html

Re: UNIX Shell Logging

Steven E. Protter — Tue, 21 Jul 2009 10:25:18 GMT

Shalom Johnny,

I would go with auditing for the server as recommended above.

I will however explain why.

.sh_history is a wonderful file, but in order to log peoples actions they need read-write permission to the files.

This means they can alter the contents.

Auditing collects data in a file that only root can access. Therefore a user trying to cover their tracks or mistake can not.

SEP

Re: UNIX Shell Logging

Mel Burslan — Tue, 21 Jul 2009 11:16:50 GMT

If you are looking for an enterprise level solution with logging to remote server, where even the root user does not have direct access to, unlike auditing, I'd suggest using PowerBroker from symark software.

Re: UNIX Shell Logging

Johnny2009 — Tue, 28 Jul 2009 08:22:40 GMT

Thanks for the response guys. Appreciate it.

Re: UNIX Shell Logging

Olivier Masse — Tue, 28 Jul 2009 12:05:33 GMT

Some places force everyone to run root commands using RBAC or sudo. But that's very intrusive, I don't like that solution.

Something more transparent consists of using the auditing subsystem to log most exec() calls and you would have the equivalent of what you're looking for, i.e. a timestamp, a command, and a username.

If on the other hand you want to log complete interactive sessions, meaning you would like to be able to playback what users did on their terminal and see what they saw, there is something now that does this and it's better than using script(1). I saw at HPTF2009 (in a non-NDA session) that HP developped such a tool, but I'm was not able to download Ron's slides so I don't know if it's available yet and what it's called.

Good luck

Re: UNIX Shell Logging

Johnny2009 — Wed, 29 Jul 2009 09:41:20 GMT

OK - so I have started the auditing system taking mostly deault parameters, but dis extend the list of events within the /etc/rc.config.d/auditing
AUDEVENT_ARGS1="P -e login -e admin -e delete -e modaccess -e open"

I then logged into the sysetem via telnet, touched a file, vi the file, the rm the file, then logged out.

Yet, when I then view the audit trial using audisp , I only see my login, but no other activity.

I thought that the event list provided within the AUDEVENT_ARGS1 list would have captured all my events?

any ideas where I have gone wrong on this one?

thanks
Johnny