user session logs

[Michael G Jaynes]

Because of SOX, we are no longer able to login as user root. However, the other sys admin and I login as our usernames and then su to the root account to perform most of our work. We use a SSH terminal session to login. Is there a way to prevent the root account from logging in this manner. I wouls like to give a screenshot to the suditors to prove we are no longer logging in with the root account. They say it is okay that we su to the account. Also am looking in to the logs from user sessions and when I su to root, it logs a login, so I am not sure how to prove that we are no longer loggin in.

[Aneesh Mohan]

Hi,

Install SUDO software and configure the super user access to various accounts on sudo configuration file using "visudo".

Thanks,
Aneesh

[candlejack]

In /var/adm/syslog/syslog.log you can see who is switching users. For example, when I su to root I get an entry like this:

Aug 15 10:29:07 freddub su: + tZ matt-root

That shows that user "matt" is switching to "root," and not logging in directly.

[Prashanth Waugh]

Hi Michal
Check the su log the path is /var/adm/sulog
also check user history file which will be in his /home directory.

Regards
Atul

[Prashanth Waugh]

Hi ,

Check the /var/adm/wtmp and /var/adm/utmp
for user logs

Reagrds
Atul

[Deepak Kr]

Try using sudo for all sysadmin tasks for which you require root level priviledges.

Stopping root loggin whenever you switch to root id is not a good idea keeping security of box in mind.

sudo is freely available and easy to configure ...

regds...DK

[Patrick Wallek · Accepted solution]

I think everyone has missed the point so far.

To disallow root from connecting via ssh you need to modify the sshd_config file and set the option 'PermitRootLogin' to NO'.

Information available here:
http://docs.hp.com/en/5992-4213/apas02.html#v1229989

(Search for PermitRootLogin. There is also a sample sshd_config file at the bottom of the page.)

[George_Dodds]

Patricks hit the nail on the head.

In my last role we had to implement the same thing for SOX, you might well find that an auditor will come to keep you company while you run through a set of tasks for them.

We also had to run a script they gave us which checked system security.

At least that was the case the last 3 audits i had to deal with.

[Michael G Jaynes]

Thanks Patrick. That is exactly what I was looking for.

[Michael G Jaynes]

However I do not have that file at the path specified. I have 4 of them. Is the path different if I am on HP-UX 11.23?

[Patrick Wallek]

My sshd_config file is in /etc/opt/ssh.

Note that there is an sshd_config and an ssh_config (without the 'd').

Details on each are available in the man pages (man ssh_config ; man sshd_config). In a nutshell ssh_config is the client config. sshd_config is the ssh daemon config file.

[Michael G Jaynes]

I see.
I've got
/opt/ssh/etc/sshd_config
/opt/ssh/newconfig/opt/ssh/etc/sshd_config
/opt/ssh/src/ssh/etc/sshd_config
/opt/ssh/src/ssh/sshd_config

I am about to see if I can figure out what each is. Thanks for the help.

Michael

[Steven E. Protter]

Shalom,

We are under SOX and still allowed to login under root. Hmmm.

http://www.hpux.ws/?p=19

That can create key exchange only root access system to system and comply with your auditors interpretation of SOX

SEP

[Patrick Wallek]

>>/opt/ssh/etc/sshd_config
It should be this one.

>>/opt/ssh/newconfig/opt/ssh/etc/sshd_config
This is a sample file.

>>/opt/ssh/src/ssh/etc/sshd_config
>>/opt/ssh/src/ssh/sshd_config
Did you comple from source? These appear to be part of the source code.