topic Re: su log in Operating System - HP-UX

su log

Indrasen — Mon, 03 Aug 2009 12:53:27 GMT

Hi
I am a newbie to unix world and into security. can someone please help me with the below log.

Jul 24 11:55:50 su: - 8 username
Jul 24 12:12:40 su: - 10 username
Jul 26 11:15:32 su: - 7 username

I understand these are failed logins but what does that number (8,10,7) indicate??

Thanks for helping.
-Indra

Re: su log

SoorajCleris — Mon, 03 Aug 2009 13:05:23 GMT

Hi Indra,

Its your terminal number from which it tried.
And the "-" shows that it is failed.

Regards,
Sooraj

Re: su log

Steven E. Protter — Mon, 03 Aug 2009 13:06:16 GMT

Shalom,

Number of logins using su

SEP

Re: su log

Indrasen — Mon, 03 Aug 2009 13:10:16 GMT

Hi Steve (SEP),

If they are the number of logins of su, do you think any one tried to login using a tool? coz manually 8 or 10 times is not possible within a second.

-Indra

Re: su log

Pete Randall — Mon, 03 Aug 2009 13:12:44 GMT

I love it when you get such authoritative yet contradicting answers. Judging from the contents of my sulog, I would go with terminal number as a good guess:

SU 06/27 13:26 + ttyp2 root-informix
SU 07/08 11:53 + 2 tmr-root
SU 07/13 14:48 + 6 tmr-root
SU 07/16 12:43 + 2 tmr-root
SU 07/20 06:10 + ttyp1 root-jlp
SU 07/20 06:13 + ttyp8 root-jlp

Pete

Re: su log

SoorajCleris — Mon, 03 Aug 2009 13:19:01 GMT

Hi Indra,

Which is this OS?

Regards,
Sooraj

Re: su log

Indrasen — Mon, 03 Aug 2009 13:20:20 GMT

its HPUX

Re: su log

SoorajCleris — Mon, 03 Aug 2009 13:34:59 GMT

Hi,

Which version?

Regards,
Sooraj

Re: su log

Indrasen — Mon, 03 Aug 2009 13:56:47 GMT

11.11 missed to mention it before

Re: su log

SoorajCleris — Mon, 03 Aug 2009 15:05:38 GMT

Hi ,

It is the terminal number from which it tried to login.

You may see the manpage here
http://docs.sun.com/app/docs/doc/816-5174/sulog-4?a=view ( SUN - but same format followed in HPUX also)

Here is the output from my servers,

11.11
-----------
-----------
hrprd2# tail -f sulog
SU 08/02 18:09 + tty?? root-naredlv
SU 08/02 18:09 + tty?? root-naredlv
SU 08/02 18:09 + tty?? root-nareshp
SU 08/02 18:09 + tty?? root-nareshp
SU 08/03 00:00 + 0 vbinees-root
SU 08/03 05:01 + ta KumarS3-root
SU 08/03 05:42 + ta KumarS3-root
SU 08/03 06:04 + ta lkumar-root
SU 08/03 06:36 + ta lkumar-root
SU 08/03 08:58 + ta lkumar-root

11.23
============
# cat /var/adm/sulog
SU 08/02 22:36 + tty?? root-sfmdb
SU 08/02 22:36 + ttyp1 root-root
SU 08/03 10:18 + ta root-sooraj
SU 08/03 10:18 + ta root-root

Regards,
Sooraj

Re: su log

SoorajCleris — Tue, 04 Aug 2009 02:06:17 GMT

Hi,

You may assign some points if your question is answered . :)

Thank you

Re: su log

Indrasen — Tue, 04 Aug 2009 06:40:55 GMT

thanks all for your replies. i see that the number is a interface/terminal in the definition of the log in one of the log managament tool.

Re: su log

Indrasen — Tue, 04 Aug 2009 06:43:02 GMT

I found the log description in one of the log management tool and other members also in the same page.