user activity logging

[Ahmad Munawwar]

Hi,

My system specs:
N-Class
HP-UX 11.0
Sybase 12.0

Anyone can help me to trace in detail all user activity in the system, these will help me to find the caused of the problem i.e someone accidentally remove the filesystem or zerorize the binary files. Do we have any software or someone can help me to write down a script to capture those without occupy the filesystem disk.

Regards,
Munawwar

[Vijeesh CTK]

hi


simple method

just put these entires in the user's .profile

script -a /tmp/username/username.`date +%d%m`
logout

but u have to keep track on tmp filesystem as the file size of eachuser will increase day by day

CTK

[John Carr_2]

Hi

if the users are using the korn shell you could set environment variable HISTSIZE=999999 then all commands performed by a user would be recorded in the users home directory .sh_history file.

John.

[harry d brown jr]

You should make sure your binaries DO NOT HAVE WRITE permissions on them. Another step is to keep users OUT of shells and in their applications. Any access to unix commands should be done by a menu based script.

live free or die
harry

[Bill Hassell]

You can narrow down the problems by determining what users have wrtie permissions to the directories and files that were destroyed. Since all HP-UX systems are shipped with no umask sete, it is highly probable that you have dozens, perhaps hundreds of files and directories with 777 or 666 permissions. This is a severe security risk and should be addressed first. Scan the HP-UX directories with:

find / -local \( -type f -o -type d \) -perm -002 -exec ll -d {} \;

What this does is to locate files and directories that have world-writable permissions and lists them. All of them need to be fixed, especially directories since anyone can remove or rename files in a world-writable directory, even if they do not own them.

Finally, severely restrict knowledge of the root password and do not ever allow ordinary users to have a userID of 0 (zero). If you need assistance maintaining the system, use restricted SAM (see the sam man page) or get a copy of sudo which allows much finer controls over alternate root users.

[Mark Greene_1]

Another thing to consider is adding the isql login to the users .profile, so as soon as they log on they are launched into sybase and don't have the opportunity to do anything at the unix commandline.

HTH
mark

[Helen French]

Hi Ahmed:

Couple of options:

1) Enable accounting in the system to keep track of logins, processes, programs, disk space etc. Man acct (1M) for details.
2) Check the history file in the $HOME directory.
3) Check the system log files, wtmp, utmp etc.
4) Check and make sure that your important files have only read permission to users.

HTH,
Shiju

[Rita C Workman]

You could as was mentioned turn on Auditing/Trusted....but that gobbles up diskspace. And unless you have enough, this can create a problem.

Diskspace was a big issue with me. And I wanted 'in detail' info on certain users, and wanted to be able to 'control' certain privileges too. So I finally opted for a third party software (PowerBroker), there are plenty to choose from. This way I can turn on logging just for certain users ! Thus not overextended disk usage or making monitoring unmanageable...and it had some other features I liked.

Just a thought,
Rita

[Donny Jekels]

Mohammed,

I feel your pain. You mean a normal user, has removed a "filesystem"?

going forward you have all the answers right here on the discussion board. I can't add any more value to the exiting answers.

But what still puzzle me, is that a normal user can delete a filesystem.

. umount
. pvremove etc !!!!
explain

[A. Daniel King_1]

I'd like to be able to do the same kind of thing - for certain users. Are there GNU/GPL/BSD-type options for this? I've seen sudo, which is great for limited root-type access, but the [unfortunately broken] osh would - in concept - be more ideal for some of my users.

[Ahmad Munawwar]

Hi,

CTK:
Thanks for the script but concern me on the file size.

Harry:
The binary file mentioned has permission 666 but still get zeroed somehow.

Bill:
I tried to run your cmd on Hp-UX 10.xx it doesn't work ? "find: bad option -local"

Rita:
Can i download the 3pp software (powerBroker) from any URL?

Donny:
I think this was done by root user itself

Regards,
Munawwar

[Michael Tully · Accepted solution]

Hi,

Sounds like you have some security issues as well. Suggest you try to isolate the 'root' account and implement a tool like 'sudo' to allow users to do some functions (that they really need) and to prevent them from running others. You could also look at implementing a restrictive 'sam'. 'sudo' has own inbuilt logging facility.

Here is the link to where you can get the 'sudo' binary from in software depot format.

http://hpux.connect.org.uk/hppd/hpux/Sysadmin/sudo-1.6.2b1/

HTH
~Michael~

[Chris Wong]

Two things.
First, another tip for searching what a user has done. If you have the MWA change the PARM file to include "new" instead of "nonew", this will create a process entry for every action. This is more efficient than turning on auditing.
Second, I've got articles regarding using Restricted SAM, sudo, and SCM on:
http://searchhp.techtarget.com/tip/1,289483,sid6_gci821272,00.html
The table gives a summary of some of the features of each.
The 2nd part of the article should be out any day as I sent it in already.

- Chris http://www.newfdawg.com

[Systeemingenieurs Infoc]

Perhaps you should check crontabs and scripts. It could be a typo : >$binary iso $binary

Hein Coulier

[Steven Sim Kok Leong]

Hi,

While logging is a detective measure (after the harm is already done), a preventive measure would be to implement restricted sam (as some have mentioned above).

By inserting a mandatory call to restricted sam in the global profile within traps(eg. /etc/profile, /etc/csh.login etc) for specific users (based on `id -un`), a user is limited to executing the commands in rsam which can be based on privileges of a different user if you wish.

Prevention is better than cure.

Hope this helps. Regards.

Steven Sim Kok Leong

[Nick Wickens]

The system I manage is for most users fairly secure as it logs them into an in house application and then logs them straight out when they exit that application. However for the few users I do have that need other access I adopt the following -

(1) For some users certain commands are made unavailable by aliasing the command to an echo - ie rm.

(2) Make user profiles read only and monitor for anyone that changes this ie they move a writable profile in its place.

(3) Have a regular script running that checks for use of certain commands (rm chmod mv etc) every 5 minutes in the users history files. I keep a cross reference file of "reported" instances and then email to my exchange mail so that I can take action immediatly.

(4) If you can remove command prompt access completely and put every task they need to do in scripts built into a secure menu ensuring that you build traps into the menu to prevent breakout.

(5) Consider using sudo if they need higher level access - Sudo can be configured to log actions.

(6) Make sure your directory permissions across the system only give them access to what they need.

(7) Make sure that anyone with access to your backup system (omniback etc) can only recover files they own - Make sure your omniback backups are configured as "private" rather than public.

Above all be vigilent at all times - I have had staff who have attempted to exploit loop holes just to see if they can (virus writer syndrome I guess)