Monitoring users

[Jose Luis]

Hello!
I have a question:
How can I know the commands executed for the users in the system (HP-UX 11.0)?
For example, in the case of the miss of a file, how can I know, who was erase it, or change the permission of a file?
Exist an application or procedure for lookin for this activity in the system?
Thank's in advance

[Justo Exposito]

Hi Jose Luis,

What about .history file?

Regards,

Justo.

[Arockia Jegan]

By looking at their history files (.sh_history) you can find out who has done changes in the file. But there are some smart users who modify the history files if they have done some mistakes. Avoiding the generic user accounts and giving proper permissions to the files/users will help you to figure out who(some time a list of users) might have changes the files.

[steven Burgess_2]

Jose

You have the .sh_history file for each user in their home directories

There are 2 variables in /etc/profile which can control this file

HISTFILE : Contains the name of the history file
HISTSIZE : Shows how many commands are kept in the history file

[Victor_5]

You can check .sh_history under every user's home directory.

[S.K. Chan]

The .sh_history in the user's hoem directory is usually the way to check but that doesn't mean the user cannot modify or delete any traces from that file.

[Holger Knoppik · Accepted solution]

Hi Jose,

another suggestion:
Make the script command work for you! You can put it into the users profile, for example:
---snip---
script -a /var/adm/users/user1.log
---snip---

NOTE that only the script command is terminated when the user types exit. But you kann kill the PPID of his shell.

HTH

RGDS, Holger

[George Abraham_1]

hai

put a line in cron such that it will start a script each time a user logs in.. the script file will have all the commands and their output logged in...

keep smiling
george

[Ceesjan van Hattum]

In reaction to Holker Knoppik, you should not set it into the userprofile, but in the /etc/profile, which is executed as well and should not be editable for users.

Regards,
Ceesjan

[Holger Knoppik]

Hi Ceesjan,

i should have known this ! OK, by default the user's .profile has permissions r--r--r--. The owner is the user himself. How about a chown root:sys to the .profile ? I would check that the script command does not run for root.

Just by the way ;-)

RGDS, Holger

[Martin Johnson]

You may want to look into accounting to audit some activity.

HTH
Marty