Logging telnet/ssh sessions on non-trusted systems

[Martin J. Buxton]

I'd like to log telnet and/or ssh logins on a non-trusted 11.11 system.

Does anyone know of any scripts or applications that will perform this?

Thanks for any and all replies.

[Victor Fridyev · Accepted solution]

inetd -l

Or change the configuration of /etc/inetd.conf to do the same thing.

[James R. Ferguson]

Hi Martin:

Create (touch) '/var/adm/wtmp' to log successful logins. Create (touch) '/var/adm/btmp' to track unsuccessful logins. Both files should be owned by 'root' and writeable only by root.

In the case of the 'btmp' file, do *not* confer read privileges to other than root. To do so may expose password or other sensitive information to non-privileged users.

In addition to the 'wtmp' and 'btmp' files which can be examined with 'last' and 'lastb' respectively, you should also examine the switch-user ('su') log:

# /var/adm/sulog

You will see entries that look like:

SU 07/17 11:00 - ttyp3 jrf-root
SU 07/17 11:01 + ttyp3 jrf-root

...a "-" indicates failure; a "+" signals success. The direction of the switch is shown as the last field.

See the manpages foor 'last(1)' for more information.

Regards!

...JRF...

[Martin J. Buxton]

The "inetd -l" seems to do the job. How would I set it up in inetd.conf for default logging?

[Pierre Pasturel]

HPUX Host IDS runs on 11.11 and monitors wtmp/btmp and sulog for both successful and failed logins/su, has hooks to perform actions (e.g., send a page, email) when certain attempts are detected, and allows you to centrally manage and monitor multiple systems.

It might be overkill for what you need.

http://h20338.www2.hp.com/hpux11i/cache/324806-0-0-0-121.html

Pierre

[Harjit]

>>The "inetd -l" seems to do the job. How would I set it up in inetd.conf for default logging?

Set export INETD_ARGS="-l" in file /etc/rc.config.d/netdaemons