topic Re: Check when a script has been executed in Operating System - HP-UX

Check when a script has been executed

CharliePuyol — Tue, 06 Jan 2009 20:30:28 GMT

Hello

I was using HIDS but it looks that it doesn't have an option to check if somebody executed a shell script, please help me if somebody know how to track if any user executed a shell script, if HIDS do that or if other application do that!

By the way, the OS is HP-UX 11.23...

ThanX!

Re: Check when a script has been executed

TTr — Tue, 06 Jan 2009 20:54:14 GMT

The formal way to do what you are asking is to convert your server to a "trusted system" and do user auditing. trusted system is more challenging to manage and uses some cpu and disk resources. Without trusted system you can check the user's command history file (default is ~/.sh_history for posix shell users) to see if they typed the shell script name. This is not however a definite check, smart users can purge their command history so that you will not see the command in there.

Re: Check when a script has been executed

James R. Ferguson — Tue, 06 Jan 2009 20:55:22 GMT

Hi Charlie:

One essential problem with tracking the execution of shell scripts is that a shell script must be *readable* to be interpreted and therefore executed. This doesn't apply to the root user, of course, but does mean that you need to differentiate between merely reading a script and actually executing it.

Regards!

...JRF...

Re: Check when a script has been executed

CharliePuyol — Tue, 06 Jan 2009 21:09:16 GMT

Sorry for this question but I'm not really familiarized with trusted systems how can i activate via sam?

Re: Check when a script has been executed

TTr — Wed, 07 Jan 2009 00:31:42 GMT

Do not activate it yet. First become very familiar with it because there are other restrictions and caveats that come with the trusted system.
http://docs.hp.com/en/5992-3387/apas01.html?jumpid=reg_R1002_USEN

Re: Check when a script has been executed

Dennis Handly — Wed, 07 Jan 2009 01:32:34 GMT

>if somebody know how to track if any user executed a shell script

You can of course change the script to log who used it and when and the parms.