Detecting users who have "su"ed to root.

[Dale Barnes]

When a user performs an su to root, who does not show this since apparently the su does not modify the utmp file. I am looking for an easy way to identify any and all users who have su'ed to root. I know of a tedious way; executing a 'ps -eH -o pid -o ppid -o user' allows one to trace down an detect if a user has a subshell which is owned by root. This, however, is tedious. I am looking for a simpler way.

[Rita C Workman]

Here's a couple tips:
Under /var/adm is sulog...and it shows everyone who did a su

Now under my /var/adm/syslog/syslog.log I also see whenever anyone does a su.....So I do a little script occassionally on this or sulog to check it-example:

cat /var/adm/sulog | grep root$

It looks to see for any line ending in root.....which would mean someone su-d to root...

Regards,

[Kofi ARTHIABAH]

Would the file /var/adm/sulog help you? it lists who has used the su command to become who... ie. user to root, root to other users, other users to other users... with timestamps...

[Maureen Gunkel]

Paul:
There should be a log file in /var/adm called sulog, that might help you.
HTH
Maureen

[Rick Garland]

The sulog file will give the details you are looking for
who - what - when

[Dale Barnes]

Yes, thanks. I am aware of the sulog file. What I was looking for is an easy to way to ascertain who is CURRENTLY su'ed to root. The sulog will show me who has su'ed to root. The sulog file will have that entry but will not tell me if the user is still logged in to root.

[Paula J Frazer-Campbell]

Hi Paul

You have a security situation / disaster brewing if your users can su to root ? users will quite happily type rm ?R * and forget where they are and the fact that they are su-ed to root.

If users must have root permissions to carry out certain tasks then you can set them up in restricted SAM or download and install SUDO, which will allow you to set the su commands that a user can run.

http://hpux.cs.utah.edu/hppd/hpux/Sysadmin/sudo-1.6.2b1/

Basically give your users just enough and no more.

Paula

[Rhonda Thorne]

Here is a script I have written and run through cron that shows me all users that have su'd to root ( successful or not). I then mailx it to my exchange account.

echo "Here are the su to root list for yesterday" >> /tmp/sec.list
grep `date +%m/%d` /var/adm/sulog|grep -e "-root" >> /tmp/sec.list
mailx -s "su list" sysadmin2 < /tmp/sec.list
rm /tmp/sec.list
~

Rhonda