trapping attempts to assume identity of another user

[Akhil]

Hi,

I have two questions

1. What are the various ways by which a user can attempt to assume the identity/permissions of another user?

2. What are the ways to trap those successful and unsuccessful attempts?

Thanx
Akhil

[melvyn burnard]

One way is that they can use the su (Switch User) command.
man su

this logs to the sulog known as /var/adm/sulog

Also it logs it into syslog.log if I remember correctly.
There are of course many other additional pieces of software you could install, such as sudo, and these will log differently

[Akhil]

Thanx Melvyn,

I am aware of "su" and "/var/adm/sulog", but what i wanted to know was other ways to assume the identity and trapping that attempt, successful or unsuccessful.

Thanx
Akhil

[Akhil]

Another way which i can think of is "login" command. Is there anyway to trap this?

[Mark Vollmers]

What do you mean by trapping? If you want to prevent people from doing this (the login command or su or whatever), you can always modify the shell to either lock out these commands or to have the commands do something else (log any attempts, etc).

Mark

[harry d brown jr]

If the setuid bit is on an executable, say ksh, and the owner of the file is another user, then yes, they can "become" that user.

[Akhil]

I want to send an alarm as and when the attempt, successful or unsuccessful, is made to assume another user's identity, maybe using any method e.g using "su", "suidbit" or " login"

thanx

[Sundar_7]

Hi Akhil,

U can consider doing the following things..

* If U want to trap unsuccessful 'su' attempts

Pls have a look at

/var/adm/sulog file with

-

User1 is trying to switch to User2 but he

failed to give the correct password..

SO U can write a simple script to analyze

the log and create an report..

* If U want to trap Unsuccsful login attempts

then U can user "lastb" command..

Also U can enable "auditing" and audit

the unsuccessful login attempts

What else U need ?

Sundar

[Akhil]

Suppose, my login-id is 'akhil' and I login with this id and I am currently in my home directory '/home/akhil'

From my home directory I try 2 things:
1.'su' to another id 'james'
2.'login' to another id 'james'

Now, How do I send an alarm for each of these attempts, regardless of whether it is unsuccessful or successful.

The alarm should be such that it says that id 'akhil' trying to assume id of 'james'.

Thanx

[Wodisch]

Hello Akhil,

you can monitor the "sulog" with something like
the followinf script running in the background:

#!/usr/bin/sh
nohup tail -f /var/adm/sulog | while read line; do
echo $line | mailx -s"SU" akhil
done

or you may write your own "PAM" module to it
(that's "Pluggable Authentication Module" - see man
page on "pam.conf").

HTH,
Wodisch