topic Re: SU activity in the SULOG - "+0" in Operating System - Linux

SU activity in the SULOG - "+0"

Suriah — Wed, 25 Jun 2008 07:07:11 GMT

Hi,
I noticed that in some instances the SULOG contains something like "SU 09/16 10:34 +0 root super".

What does "+0" means?

Re: SU activity in the SULOG - "+0"

Dennis Handly — Sat, 28 Jun 2008 00:18:18 GMT

On HP-UX that "0" field is the tty of who did it. "+" means successful and 0 may be an indicator there was no tty? (HP-UX has "???".)

Re: SU activity in the SULOG - "+0"

Suriah — Mon, 30 Jun 2008 00:33:59 GMT

Thanks. Does it mean that the SU was triggered by system program or daemon?

Re: SU activity in the SULOG - "+0"

Dennis Handly — Tue, 01 Jul 2008 08:28:04 GMT

>Does it mean that the SU was triggered by system program or daemon?

I suppose by those too.
But in most cases, cron or at/batch wouldn't have a tty.

Re: SU activity in the SULOG - "+0"

Dennis Handly — Tue, 01 Jul 2008 08:39:58 GMT

Hmm, I just took another look and I see entries with:
+ 14 old-new # done by sudo type command?
+ tty?? old-new # done by cron?
+ ttyq3 old-new

So I'm not sure how that 14 or 0 maps to a tty?

Re: SU activity in the SULOG - "+0"

Matti_Kurkela — Tue, 01 Jul 2008 12:26:05 GMT

tty?? means the su command was unable to determine the tty used, probably because there was none (e.g. when a cron job executes the su command).

ttyq3 refers to legacy BSD-style pseudo-TTY /dev/ttyq3.

The plain number might refer to new-style pseudo-TTYs (the number 0 meaning /dev/pts/0, etc...), if your su command shortens the tty name all the way to the right-most slash. In this case, your su command might need a patch.

The su command of my Debian 4.0 workstation outputs /dev/pts/0 as "pts/0" in the su log message. This su command is part of login-4.0.18.1-7_i386.deb package.

MK

Re: SU activity in the SULOG - "+0"

Suriah — Wed, 02 Jul 2008 00:15:00 GMT

Thanks. In any case, would you guys consider this as a security/audit issue?

Re: SU activity in the SULOG - "+0"

Dennis Handly — Wed, 02 Jul 2008 11:37:17 GMT

>would you guys consider this as a security/audit issue?

In what way? That you don't have enough detailed info?
You know who did it and when. You just need to track down the login info for that user.