find out all user

[prateek_1]

I need to find out all user who logged in my host and what modification they done.

[Ganesan R]

Hi,

Need more details. If you need to know the currently logged in users use #who -u command or #w

If you have enabled auditing you can findout which user did what.

[Sani]

Hi ,

use "whodo" to find out logged in users and process running by those users.

Regards
Sani

[prateek_1]

I need all user currently as well as previously logged on system and in which file they done any modification with the IP address of user.

[T G Manikandan]

What version of HPUX you are running, you need to convert your system to a trusted mode to enable auditing to find all information.

[Johnson Punniyalingam]

Hi Prateek,

Have you turn on audting in your Server .?

If you Server Trusted System.? if not bit difficult... :(

# last -R user1 user2 user3

(above command will give login history with IP address of user1,user2,user3)

Hope This Helps,

Tks,
Johnson

[Robert-Jan Goossens]

Prateek,

You need to have a look at the system audit tools. I don't know what versionof HPUX you are running, but have a look at the below link and search for audit.

http://h20392.www2.hp.com/portal/swdepot/searchProducts.do

Regards,
Robert-Jan

[prateek_1]

Hi,
how can i turn on audting in my Server,commands mentioned by you give me o/p like--
bash-2.05# last -R user1 user2

WTMPS_FILE begins at Thu Jan 29 19:42:29

[prateek_1]

im using 11.31 sep08 fusion.

[Ganesan R]

Hi Prateek,

Use SAM to convert the system into trusted mode. Once you converted to trusted you can enable auditing.

SAM -> Auditing and Security ->Goto Actions ->Convert the sytem

[Fred Ruffet]

Turning system into trusted mode may not be done to fast. It may have side effects that need to be studied.

Regards,

Fred

[prateek_1]

Thanks ganesan ,now i m able convert the system into trusted mode.

but above command are giving same o/p--

bash-2.05# last -R user1 user2

WTMPS_FILE begins at Thu Jan 29 19:42:29

i need to find out the ip of user and check where and what changes he/she had done.

[Fred Ruffet]

The "last" command will only tell you who logged in, from which IP and at which time. But it won't tell you what action has been made. If it's a shell action, you will have information in the .sh_history file of the user (if it exists).

Regards,

Fred

[Jeeshan]

duplicate thread has been opened. close one

http://forums11.itrc.hp.com/service/forums/questionanswer.do?threadId=1316984

[prateek_1]

sure ahsan,

[prateek_1]

Hi fred ,

.sh_history is not here but i can see some previous command on .bash_histroy.but its difficult to me to specify which command used by which user.could you help me on that

[Duncan Edmonstone]

Is this something you need to do going forward, or are you actiavely trying to determine a change that someone has made in the past?

If the latter, it sounds to me like its too late. Enabling auditing won't show you what happened *before* auditing was enabled! Only what has happened since it was enabled.

A couple of other points:

i) Don't convert to a trusted system... hou don't need to to enable autiting in 11iv3(11.31). In fact trusted systems will be deprectaed in a future release.

ii) If you really wanto to setup auditing correctly I suggest you *read and understand* the section of the manual that covers this:

http://docs.hp.com/en/5992-3387/ch10.html

It really isn't as simple as running a couple of commands and magically getting what you want. You bhave to take ther time to decide what you're going to audit and then configure collection and manage the ongoing production of audit logs...

HTH

Duncan