AIX

Hello Team,

In my environment , Application team using winscp to create/modify/delete the files in the AIX server from their windows boxes. I have enabled the user history, su logs and lastlog, but the users whoever using winscp its not getting tracked. How to enable the WINSCP logs in AIX level ?? Can someone please advice.

Regards,
Gowtham.G

I cannot speak to AIX; however, WinSCP is a client tool I have used to access Solaris and Linux systems. You can have users enable activity logging in WinSCP, but you cannot enforce it without setting up group policies. To my knowledge you cannot execute the SU command in the GUI, but you can in the terminal (either the built-in or by linking to PuTTY).

So... question for you... are your users using their own credentials to access the server, then using SU through the terminal session to get elevated priviledges? If so, then your logging should catch their activity. Alternately, are the users using the elevated accounts (i.e. root) in the GUI to access the server directly? If so, you will not see who is using the root account, only that the root account took some action.

One way to overcome this is to remove login capability from all elevated accounts and force users to login with their own accounts, then SU to the elevated accounts. Many admins would consider this a safer approach anyway.

AIX, like most UNIXes has built in auditing. Perhaps that would work for you.

More info here:
Use auditing to track reads and writes in a file

Here are the steps:

1. Edit /etc/ssh/sshd_config to enable
#SyslogFacility AUTH
#LogLevel INFO
#Subsystem sftp /usr/sbin/sftp-server
2. Edit /etc/syslog.conf
auth.info /tmp/wtmp rotate time 1d
3. touch /tmp/wtmp
4. refresh -s syslogd
5 stopsrc -s sshd; sleep 5 ; startsrc -s sshd &
(Then reverse the step to restore system)