topic Re: Linux log in Operating System - Linux

Linux log

Duffs — Thu, 23 Nov 2006 04:40:49 GMT

Hi,

I am using RedHat AS4 and I need to capture the ssh login details of different users including the commands they use whilst logged in. So far this level of detail does not get logged in either the messages file or the secure log file.

Does anybody know of additional software or possibe ssh logging options that might enable me capture this amount of detail?

Rgds,
D.

Re: Linux log

Alpha977 — Thu, 23 Nov 2006 04:59:06 GMT

Hello!

Usually you can see the ssh log connection into /var/log/secure.

If i remember, iptables write into this log files and you can see there.

Re: Linux log

Duffs — Thu, 23 Nov 2006 05:36:04 GMT

Hi,

I know that the secure log provides limited ssh detail but it does not include the commands that are used by individual users while logged in. I am not using iptabes and have SElinux disabled so this is of no use to me.

R,
D.

Re: Linux log

Ivan Ferreira — Thu, 23 Nov 2006 08:05:27 GMT

You can use process accounting (accton, lastcomm, etc).

Another option is to use the script command. Add the script command to the /etc/profile catching selected user (if). See man script for details.

Re: Linux log

Heironimus — Mon, 27 Nov 2006 17:35:13 GMT

If you need that level of auditing you can't rely on /etc/profile or any other login script because they're too easy to bypass. If you only want to audit shared accounts like oracle a locked password and proper sudo access would do it. Another option is to use a special auditing shell such as EASH that captures all keystrokes, but that is extremely invasive and may log sensitive information such as passwords.

Re: Linux log

Silju — Tue, 28 Nov 2006 04:03:28 GMT

Hi Duffs,

Power Broker is the software you are looking for. It can do more than just loging the activities of the user.
You can get more details on this site.
http://www.symark.com/powerbroker.htm

SUDO also can help you in this case.
http://www.gratisoft.us/sudo/sudo.html

Regards
Silju

Re: Linux log

George Liu_4 — Tue, 28 Nov 2006 14:15:06 GMT

Change
LogLevel
in /etc/ssh/sshd_config

The possible values are: QUIET, FATAL, ERROR, INFO,VERBOSE, DEBUG, DEBUG1, DEBUG2 and DEBUG3. The default is INFO.

Re: Linux log

Ivan Ferreira — Tue, 28 Nov 2006 15:41:43 GMT

See also:

Enterprise Audit Shell (eash)

Re: Linux log

Duffs — Tue, 26 Feb 2008 16:07:27 GMT

Thanks for the feedback. I went with sudo.
R,
D