Command auditting on HPUX

[TEC-HP]

Hello,

Is there a way to implement command auditting on HPUX for interactive sessions?

[Artyom Voronchihin]

Hello!
Audit user's history file. For example
tail -f /home/user/.sh_history

[Jeff Schussele]

Hi Cristophe,

If your system is already set for Trusted mode then you can turn on auditing by editing /etc/rc.config/auditing to define just what system calls to audit and what size files to create & turning it on with /sbin/init.d/auditing start.
I strongly recommend you study the man pages & only audit what you really need because on a busy system you can quickly roll up some huge audit files if you don't configure it to only audit specific events.

HTH,
Jeff

[TEC-HP]

Ayrtom, Jeff

Thanx for the replies
I should have mantioned it from the begining:
Goal is to have "lightweight" auditing:
The history file is not realy an option as it can be tampered by it's owner
The builtin auditing is indeed overload in the scope I'm searching for:
Temporary root-delegation via a jumphost (key based ssh): only as last resort where sudo isn't enough

[Jeff Schussele]

Hi (again) Christophe,

Just a couple of comments on the history file.
IF a user edits *any* history file it immediately becomes unusable. This is because it's not a "standard" text file. It has strategic control characters inserted in a specific pattern such that *any* editing upsets this pattern rendering it useless.
Even considering this, one could consider setting up a root cron job to periodically copy it out to a restricted directory to insure it can't be erased & to keep an *accurate* history of that user's commands.
And as to auditing it's not too hard to construct an auditing config file to *only* audit the "destructive" types of system calls & keep the audit files to a managable size. We do this & also employ cron jobs to rotate these files and coupled with tape backups we can keep a fairly long history of them.

My 2 cents,
Jeff

[TEC-HP]

Hi all,

Sorry for this late reply. Thanx for your input.
We will examine some of the possibilities.
Note:
BASHA seems to the thing we need, but then there are some support issues which need to be solved in-house(http://unix.freshmeat.net/projects/basha/)