track rlogin,remsh,rcmd

[Pradep]

Hi Matti,

inetd -l is tracing the connection source.
but not telling which user initiated it.
how to find the user pls.

[Suraj K Sankari]

Hi,

You can check your syslog.log file

Suraj

[Matti_Kurkela]

"inetd -l" gives you dates & times when someone used rlogin (or any other inetd service).

Run the "last" command to get a list of logins by time & username. When you find a login time that matches the time of the rlogin use (with an accuracy of about +/- 1 second), you'll know the name of the user account that was accessed with rlogin.

If you have assigned personal user accounts to each user, the name of the user account should normally be enough to identify the user.

If you have user accounts that are used by multiple users, you may have to examine the logs of each rlogin client machine to find out who was using them at the time rlogin was used. (And you will also understand by experience why security auditors say that multi-user accounts are a bad thing.)

MK

[Pradep]

Thanks, Matti.
Is there a way to find the connections initiated from the server.
inetd -l is showing only the ones coming to the server.
thanks.

[Mel Burslan]

unless accounting is turned on the source system (initiating system) there is no traces of what application has been launched on this system. rlogin or remsh are just mere applications. Short of putting wrappers around these executables to log something to some log file, you are pretty much out of luck tracking them.

[Pradep]

Thank you all.
I close the thread here.