Users Audit on HPUX

[Nappy_1]

Is there a way or a tool on hpux to find the commands that has been entered by a specific user

[R.O. · Accepted solution]

Hi,

You can to setup the history file. Take a look a this thread:

http://forums11.itrc.hp.com/service/forums/questionanswer.do?threadId=1423572

Regards,

[Pete Randall]

The history file is the quick and simple way to get some idea, but is hardly ideal - in particular because the user can edit the file themselves. For a comprehensive solution you would need to turn on auditing, which requires your system to be trusted. I think both can be done through SAM - you might want to take a look at that.


Pete

[Ron Freund]

Shell history is logical. But if you're watching for nefarious activity, may I suggest the Host Intrusion Detection System available from https://h20392.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=HPUX-HIDS

Get release 4.3, study the manual and learn its capabilities. The agent can alarm a central system when privs are elevated, when certain files are accessed, filters can be setup. Very useful, very powerful (imo).
R

[Jeeshan]

Hi

Modify /etc/profile, and add,

DATE=`date +%d_%b_%o_%a_%R:%S`
DEST=`hostname`
ORI=`who -R am i | awk '{print $6}' | cut -c2- | cut -f1 -d ')'`
mkdir -p $HOME/.historicos
HISTFILE=$HOME/.historicos/$DATE.$DEST.$ORI.$LOGNAME.txt
export HISTFILE
HISTSIZE=16384
export HISTSIZE

This will create a file in every user's directory. you can check which user's putted which commands in addition with some info.

[S.N.S]

Hi,

As Pete mentioned, the user can makes changes.

Also, when System is made trusted - the audit logs grow large very soon - take care of that.

However, looking forward, you might need to use Bastille:

http://forums11.itrc.hp.com/service/forums/questionanswer.do?threadId=1061420

HTH
SNS

[Suraj K Sankari]

Hi,

Check the user's .sh_history file.
but this file can be edited by the user
for proper solution you need to enable auditing.

Suraj