security problem

[chuanpeng.wang]

Customer want to log everything that the users does on the system such as who, when login and logoff, what he does, etc.

Can we do these without third part software?
Is nettl or auditting system for this?

Thanks.

[Yang Qin_1]

You can find login logout information with last (lastb bad login) if you didn't cleaned you /var/adm/wtmp /var/adm/btmp

You can check user's .sh_history file for all commands he/she typed but there is not time stamp.

You can also turn on the system audit from sam

Yang

[rariasn]

Hi chuanpeng.wang,

Modify /etc/rc.config.d/netdaemons file and include:

export INETD_ARGS="-l"


Reestart "inetd" daemon with option "-l"

# ps -ef|grep -i inet
root 1452 1 0 Sep 21 ? 1:10 /usr/sbin/inetd -l

rgs,

[rariasn]

Sorry,

View information in /var/adm/syslog/syslog.log file. Sample ssh login:

Oct 13 10:03:11 minerva sshd[2229]: Accepted publickey for userfrom 172.16.0.41
port 54829 ssh2

rgs

[Bill Hassell · Accepted solution]

These commands will help. Assuming the user logs on as user1:

last -R user1
cat ~user1/.sh_history

Now these are not a complete picture at all. For instance, the user may edit a file with vi, then issue the vi command :!sh and now the user can run any commands without a trace.

You could setup the script command to track all the keystrokes and text sent to the screen but plan to spend a lot of time looking over all the output. It sounds like your customer does not trust a user. Rather than fixing the blame due to a mistake, tell your customer to create a safe menu rather than giving the problem user(s) a shell login.

[David Bellamy]

When user is created add the script command in their profile.