Check when a script has been executed

[CharliePuyol]

Hello

I was using HIDS but it looks that it doesn't have an option to check if somebody executed a shell script, please help me if somebody know how to track if any user executed a shell script, if HIDS do that or if other application do that!

By the way, the OS is HP-UX 11.23...

ThanX!

[TTr]

The formal way to do what you are asking is to convert your server to a "trusted system" and do user auditing. trusted system is more challenging to manage and uses some cpu and disk resources. Without trusted system you can check the user's command history file (default is ~/.sh_history for posix shell users) to see if they typed the shell script name. This is not however a definite check, smart users can purge their command history so that you will not see the command in there.

[James R. Ferguson]

Hi Charlie:

One essential problem with tracking the execution of shell scripts is that a shell script must be *readable* to be interpreted and therefore executed. This doesn't apply to the root user, of course, but does mean that you need to differentiate between merely reading a script and actually executing it.

Regards!

...JRF...

[CharliePuyol]

Sorry for this question but I'm not really familiarized with trusted systems how can i activate via sam?

[TTr]

Do not activate it yet. First become very familiar with it because there are other restrictions and caveats that come with the trusted system.
http://docs.hp.com/en/5992-3387/apas01.html?jumpid=reg_R1002_USEN

[Dennis Handly]

>if somebody know how to track if any user executed a shell script

You can of course change the script to log who used it and when and the parms.