topic lastb, syslog and scripts in Operating System - HP-UX

lastb, syslog and scripts

Anthony deRito — Fri, 11 Jan 2002 14:34:52 GMT

1. Cannot run trusted at this time. Want to set up syslog to log failed logon attempts. Is this possible? How? In syslog.cong tried:

auth.debug /var/log/all/auth.log

did not work and don't want to run syslog in debog mode.

2. Cannot run trusted at this time. Want to run auditing tools to monitor lastb, system calls, process autdits, etc... Any one know of some good URLs for scripts to do this?

thanks

Tony

Re: lastb, syslog and scripts

Uday_S_Ankolekar — Fri, 11 Jan 2002 14:57:29 GMT

Hi,

If you are are looking for system account
then have a look at man pages of turnacct and runacct.

Also have a look at following doc

http://us-support.external.hp.com/cki/bin/doc.pl/sid=180b7b171ae9756c09/screen=ckiDisplayDocument?docId=200000024603008

Goodluck,
-USA..

Re: lastb, syslog and scripts

Anthony deRito — Fri, 11 Jan 2002 15:17:10 GMT

As mentioned, I am unable to run trusted at this time. Is not true that trusted mode is required to run system accounting? If my thinking is correct, then I am unable to use your suggestions of enabling system accounting. If it is not correct, can you point me to a document that supports the idea of running system accounting without converting to trusted.

Tony

Re: lastb, syslog and scripts

Uday_S_Ankolekar — Fri, 11 Jan 2002 15:40:35 GMT

Antonio,

I understood your query. It's NOT required a trusted system to run this accounting.

Also have a look at this doc..

http://us-support3.external.hp.com/cki/bin/doc.pl/sid=2c805c051d7b228bbb/screen=ckiDisplayDocument?docId=200000049411505

-USA..

Re: lastb, syslog and scripts

Deshpande Prashant — Fri, 11 Jan 2002 20:52:00 GMT

HI
You may want to run a script in cron to run lastb command with output redirected to /var/adm/syslog/syslog and then trim the btmp file.

Thanks.
Prashant.

Re: lastb, syslog and scripts

Mark Fenton — Sat, 12 Jan 2002 00:53:28 GMT

not sure what scripts you'll find, but you definately DON'T want to stick output from lastb into syslog or anywhere else that anyone other than root can read it.

Re: lastb, syslog and scripts

Anthony deRito — Mon, 14 Jan 2002 16:03:56 GMT

Uday, sorry to get off the track but it is system auditing and not system accounting that I am interested in. And I am pretty sure that turning on system auditing requires trusted.

Mark, lastb is one of my issues. I found a great tool called logcheck that performs some good auditing checks.

http://www.psionic.com/abacus/logcheck

The problem is that it appears to use the syslog facility for all of its information. However, it has notification built into it that informs me via e-mail when/if a breach occurs. (I realize this is not optimal.)

One of my problems is with bad logins. When a user causes three bad login attempts, how would I get notified of this? I want to have an automated process that informs me immediately of the issue. I would not want to pipe output of lastb to syslog so that logcheck can catch it but how else would I monitor bad logins without the auditing subsystem turned on?

Re: lastb, syslog and scripts

Uday_S_Ankolekar — Mon, 14 Jan 2002 16:23:06 GMT

Hi,

I was thinking you might want to do accounting on the system since "trust"ing the server is pretty much required for auditing.
I'm sorry for the previous posts

-USA..