View the su logs

[johnnymac_1]

Is there away to view a file that list all the su activity for users? This would be succesful and failed su. At a minumum what about failed su to root activity? HP-UX B.11.23.
Thanks John

[Steven E. Protter · Accepted solution]

Shalom,

/var/adm/sulog

Any user can read them.

SEP

[Manix]

yes all logs are @ '/var/adm/sulog '

Could set up a cron job to check sulog periodically and report any failed attempts to su to root (indicated by - instead of +). This is pretty crude example, but should give you the general idea of what needs to be done.

#!/usr/bin/sh

grep "root$" /var/adm/sulog | grep " - " | mailx -s "Failed root su attempts" someone@somewhere.com

http://h30499.www3.hp.com/t5/Security/How-to-log-failed-attempts-to-ROOT/m-p/3699147#M11226

[johnnymac_1]

Manix,
My sulog appears to only retain for specified period. It is cleared upon reboot and a OLDsulog file is created for the previous day. Both files only contain a 24 hour period. In order to keep a copy of all my su activity I was going to run a cron job. In Solaris cron -e edit the cron file but in HP-UX is it crontab -e? If yes are cron jobs setup pretty much the same; that is specify the time/date and file to execute?My script will create a directory with the date of the system clock, so I will need to figure out how to to this.

[Manix]

please read this

http://docs.hp.com/en/B2355-90128/crontab.1.html

crontab -e

Edit a copy of your crontab file, or create an empty file to edit if the crontab file does not exist.

crontab -l

List your crontab file.

The entries in a crontab file are lines of six fields each. The fields are separated by spaces or tabs. The lines have the following format:

minute hour monthday month weekday command

example,

0 0 1,15 * 1 command

[johnnymac_1]

A million thanks to both of you for your help.

[Manix]

Thanks A lot

Manix