User log in log

[JI HUI]

Is it possible to track who is log in at what time and what commands have been used in HP-UX 11.11? Do I need to install extra software package?

thank you.

[Tom Geudens]

Hi,
Try
#man utmp
for starters.

Hope it helps,
Tom Geudens

[Eugen Cocalea]

Hi,

To see who was logged in (and / or still is), use 'last' and the realted files /var/adm/wtmp and /var/adm/btmp.

For seeing what commands they used, check their command history (like ~user/.sh_history) (the simplest but not most secure way).

E.

[harry d brown jr]

JI,

In my opinion, the best way to see what commands users entered at a shell prompt, is to keep them out of shells, by keeping them wrapped into their applications.

http://people.hp.se/stevesk/bastion.html

live free or die
harry

[Roger Baptiste]

Hi,

You can check up who loggedin (and logged out) by running the last command (which reads the /etc/wtmp file). You can also look at the
/var/adm/syslog/syslog.log file for the login info.

Regarding the commands used by the user's, set up HISTORY on their accounts. This will log the commands they use. (in the .profile file of the userid's add the line
HISTFILE=$HOME/.sh_history ). But this file can be overwritten by the user!.

Unless this is not an ultra-secure system, i wouldn't suggest going to the extent of minute tracking. If you set the permissions and ownerships of the system correctly, there is little danger of malice from regular users.

HTH
raj

[harry d brown jr]

Have a look at this document:

http://www.defcon1.org/secure-command.html

live free or die
harry

[Santosh Nair_1]

If you want to track the user that closely, then you'd have to turn on accounting. Keep in mind that there is a performance penalty for using accounting since it tracks every command issued by every user.

Hope this helps.

-Santosh