topic Re: Sysloging from Remote Users in Operating System - Tru64 Unix

Sysloging from Remote Users

Bardill — Tue, 13 May 2003 09:05:48 GMT

Hi
I am a SUN Sysadmin.
Now i musst supervise a TRUE64 UNIX System.

I would like to supervise all user log in. the user which via telnet, Rlogin etz at the system announce themselves. With SUN inetd the service with t must be started and in syslog.conf auth.notice inserts to become. What has to be done with TRUE64 everything? can someone help me?

Re: Sysloging from Remote Users

Ralf Puchner — Thu, 15 May 2003 09:19:44 GMT

there are several ways to log user logins.

First it is possible to use the old syslog.conf mechanism by adding the same keywords (man syslog.conf).
In 5.x systems you can use the evm-system by filtering sys.unix.syslog.auth events (man evm).
Or you can use the C2 subset (man secsetup)
Or you can use the audit feature (man 7 audit)

Re: Sysloging from Remote Users

Michael Elleby III_1 — Sat, 17 May 2003 22:02:01 GMT

Here is an idea that I use on the UNIX systems I support (T64 included) that might help in the short term:

I modify each user's profile to invoke a log entry each time the user logs in. Especially the root account. A few of my T64 systems, I had to give root psw to Security group, and a couple of others, so I did this to 'monitor' the login.

If I'm not mistaken, aren't ftp's logged in the auth.log file in syslog.dated directory?

Mike Elleby