Where I should look

[wahab]

Dear all,
As a security administrator, I have just got the root password, after the production system administrator has returned it.

How can I know what they have done when they used the root password?

[Hazem Mahmoud_3]

Wahab,
In these kinds of situations it is preferred to have some type of auditing tool already in place so that you can compare the system before and after the root password was given. Various tools include Tripwire, Power Broker, Logcheck, and even IDS/9000 can serve as an auditing tool.

If there isn't any kind of auditing tool in place, the first thing to look for is the command history file for root (ie: .sh_history). This will list all the commands that root executed.

You can also take a look at the syslog (/var/adm/syslog/syslog.log) and see what system changes took place in the time frame they had the password.

Also run pwck and grpck and also take a look at the password/group files for any suspicious entries.

Last but not least, check for any suid/sgid programs that may look suspicious:
# find / \( -perm -4000 -o -perm -2000 \) -type f -exec ls -ld {} \;

Hope all this helps!

-Hazem

[Sunil Sharma_1]

Hi,

One more this to say insted of giving root password try to use sudo.

Things can be batter controlled.

Sunil

[Karthik S S]

Also check the /etc/passwd file if it has any other user than root with the uid as "0".

Just a thought ..

-Karthik S S

[John Carr_2]

Hi

if you have worries about what may have happened while soemone had root access make sure you change the password so they cannot revisit

some very worth while reading is hp-ux 11i security by Chris wong www.hp.com/hpbooks

:-) John.