su and monitoring access

[James Clay_2]

I would like to modify my systems so that the su command remembers the original details of the user such as their user ID so that if they make changes, then it becomes clearer who did them, rather than jsut 'root'.

Is this easy to do?

[doug mielke]

the su log will keep track of who / when they changed to the root user, but after that, they are root. Tracking them by their former / original name is no longer done. You're best bet is saving the su log, and comparing it to time stamps on files.

I've heard that there are 3rd party monitoring tools that promise this sort of tracking.

[George_Dodds]

I wonder if you can somehow track them from there tty id,if you want to track what they do after the su to root?

[George_Dodds]

I wonder if you can somehow track them from there tty id,if you want to track what they do after the su to root?

[George_Dodds]

odd my first reply has a submit time way after my most recent reply.

[George_Dodds]

what about just looking at /var/adm/sulog

Ta

George

[Chris Wilshaw]

James,

The following link may help - it mentions an option to allow you to keep existing environment variables when using su

http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0xcb2a16515c36ba48b0ba840e6d90bb89,00.html

I'm not sure which variables it will retain, but it's worth checking out.

Chris

[Massimo Bianchi]

I suugest you to change the istory file:

use this:

export HISTFILE=$HOME/.sh_history`tty|tr / _`_`date | tr " " _`

This way you have a different history for each user, because the do the su from different pty and at different times.

Joining this with syslog you can track all down.

Or you can enable auditing, but this is very heavy...

Massimo

[Nat Guyton]

You're looking for "sudo" functionality... http://www.courtesan.com/sudo/

[Tim Adamson_1]

Hi,

There are several products available that allow you to do this type of thing.

sudo is the one that srings to mind, although I have also seen qsu and su2 at other sites.

You should be able to establish a .sh_history_root_ when the users obtain root privledges. Of course you will need to set this up yourself. No such thing as a free lunch :-)


Tim