topic Re: Logout trace on accounting in Operating System - OpenVMS

Logout trace on accounting

gabus — Thu, 08 Apr 2010 08:00:23 GMT

Hi,
is needed to trace the login/logout access on openvms system, I suppose that a no invasive method is to use the accounting. Using the account/type=process/process=interactive command I can see the login only, not the logout. Any suggestions about? Thanks Gabriele

Re: Logout trace on accounting

Oswald Knoppers_1 — Thu, 08 Apr 2010 08:03:02 GMT

If you add the /full qualifier accounting will show start and finish time.

Oswald

Re: Logout trace on accounting

Volker Halle — Thu, 08 Apr 2010 08:20:54 GMT

Gabriele,

if you turn on image accounting ($ SET ACC/ENA=IMAGE), you could also actually see the LOGINOUT image activations for login and logout in the accounting file.

Note that activating image accounting will increase the size and growth rate of your accounting file.

Volker.

Re: Logout trace on accounting

Jon Pinkley — Thu, 08 Apr 2010 09:02:51 GMT

You may want to use auditing instead of accounting. See the following recent thread:

http://forums.itrc.hp.com/service/forums/questionanswer.do?threadId=1402904

With process accounting, nothing is written to the accounting file until the process is deleted. With auditing, the login information is written shortly after the login completes.

Jon

Re: Logout trace on accounting

gabus — Thu, 08 Apr 2010 12:45:55 GMT

Thanks for yours replies. Auditing is really the more correct process. I have seen the example in http://groups.google.com/group/comp.os.vms/msg/d724acded9a18d2a but it require Decnet. On the system that I have to monitor is present only the TCP/IP protocol. Presume that the only way to obtain login/out info is the accounting or intercept the login/out in the SYS$MANAGER:SYLOGIN.COM. I have attempt to use it with success but the file written could be open RW to all users, and this behavior is not acceptable for security reasons.

Re: Logout trace on accounting

Hoff — Thu, 08 Apr 2010 14:03:42 GMT

OpenVMS security auditing is not tied to DECnet.

Are you looking to track specific IP activities, and not the generic login and logout activities as were mentioned in the original posting?

If so, which IP activities? And which IP stack?

Re: Logout trace on accounting

gabus — Fri, 09 Apr 2010 13:23:33 GMT

I'm looking for trace all the interactive login/logout. The only service opened to interactive logins is the ssh. Gabriele

Re: Logout trace on accounting

Hoff — Fri, 09 Apr 2010 14:25:44 GMT

Reposting this. One of the usual ITRC failures has arisen and the attempt to post this dropped. Checked for a posting that got through, and didn't see one. Apologies if this does does get duplicated.

-

If you're not seeing ssh activity in the audit logs and if you have auditing for (at least for testing purposes) all process login and logout types, then that's indicative of an issue between the ssh daemon and OpenVMS.

I'd check for ECOs for whatever IP stack and IP version you're using here and then (if you have support and if the problem persists) ring up HP.

There have been various reports of, um, certain omissions and certain design oddities within the implementation of authentication within at least a few versions of the TCP/IP Services ssh daemon. I'd thought much of that had been remediated, however.

Based on a quick check with /SSH Secure Shell OpenVMS (V5.5) 3.2.0 on COMPAQ Professional Workstation - VMS V8.3/ and TCP/IP Services /V5.6 - ECO 4/, I do see login audits for a network and then a detached user; they're not the typical interactive login audits I'd tend to expect for this stuff, so they may be slipping past your selection criteria. The detached process login is probably going to be the most interesting here; that's the one you'll want to collect.

It'd be more typical if these audits were interactive logins; not sure what's up with this stuff, but it looks to be how the ssh daemon is working.