Activities of priviliged users

[Turgay Cavdar]

Are there any way to take Activities of priviliged users ? Entered commands,etc... sh_history, and sudo is not suitable for us. Any comments?

[Court Campbell]

Why is sudo not suitable. You can have more control over what users can do. Other than sudo you can use rbac if you are at least running 11.23. If for some reason you do end up using sudo, make sure to set it to log to another file. If I remember correctly it logs to syslog by default, and just makes more sense to have its own log. And as for history files, I roots profile set to setup a hist file that is per user. Then I can find out quicker and with more confidence who did what. We a scripts that then copy the hist files to another server for review. It's not full proof, but its better than nothing.

Sorry for answering about things that you do not find suitable. Seems like you will spend more time trying to do things programmatically and reinventing wheels.

[Court Campbell]

> I roots profile set to setup a hist file that is per user.

WOW... that should be:

I setup roots profile to create a hist file that is per user.

I got my mords all wixed up.

[Turgay Cavdar]

Hi the point is we try to log the activities of root. We need a way to log activities from root session itself.

[Bill Hassell]

> We need a way to log activities from root session itself.

Very, very common requirement. In many shops, the root is never allowed to login. In my shop, root's password is automatically changed every day -- and the 4 different sysadmins NEVER login as root. Instead, they use sudo, a special program to limit root access as well as LOG EVERYTHING. Just download sudo from HP's software site:

http://h20293.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=HPUXIEXP1111

Internet Express is a collection of several tools. Just pick the version of HP-UX you are using, then select the item(s) you want. All packages are in swinstall format.

Without sudo, you should have your shell history setup on *ALL* users. Add these lines to /etc/profile:

export HISTFILE=$HOME/.sh_history
export HISTSIZE=1000
export EDITOR=/usr/bin/vi

You will have to watch this file. A user that tries to hide a mistake may try to edit this file but any change to it will corrupt it and the history command will show nothing while cat .sh_history will show what's left.