Keylogger for specific users

[Brahnda Eleazar]

Peace all,

Is there any way or a tool in HP-UX (11.11 and 11.23) that can keylog for specific users only?

Thanks,
=adley=

[Steven E. Protter]

Shalom,

Sure, don't set HISTFILE and HISTSIZE in /etc/profile, set it in the users .profile file.

SEP

[Brahnda Eleazar]

Peace Steven,

Actually, my boss' idea was something like this:
If root logs in via console, the keylogger should be executed to record all root's actions (well, enlarging the history file size can do this as well).

But, whenever a non-root su to root, then it must also be keylogged (only when it acts as root). In other words, bind to its tty. Comparing sulog and the history file can achieve audit to a certain extent, but my boss wants a nicer way to do things.

Last of all, the logs of the keylogger would then be send regularly to another box.

Thanks,
=adley=

[Dennis Handly]

>whenever a non-root su to root,

I'm sure if you search the forum, there will be suggestions on not allowing this and instead use sudo to do each command, which then can be logged and which commands/users can be tailored.

[whiteknight]

Brahnda,

Seems your boss is concern on system security.

check this out on 11.23 HPUX security containment address your boss concern

http://h20293.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=SecurityExt


WK

please assign points

[whiteknight]

Brahnda,

Another points.

Log Consolidation Overview
http://docs.hp.com/en/T2786-90090/ch03s02.html


WK
please assign points

[Brahnda Eleazar]

Peace all,

Sorry for the late reply.
I was sick and just got better.

Let me look at the links first.

Thanks,
=adley=

[Patrick Wallek]

There is a commercial product called Power Broker that can do keystroke logging.

It can also control who has access to root.

Information on Power Broker available here:
http://www.symark.com/powerbroker.htm