tracking user action Post: 302088503

Sponsored Content

Top Forums UNIX for Advanced & Expert Users tracking user action Post 302088503 by Andrek on Tuesday 12th of September 2006 09:37:13 PM

09-12-2006

Registered User

Sounds like you have a problem with users, and privileged user accounts. ie oracle

You could try one of two or both... methods....you should look into the possibilities to see if they suit your needs first as they are only suggestions.

You need to get control over the �su� command. Basically stop users �su�ing to privileged accounts.

Modify the /etc/profile (Global system file) to run a script that checks to see if the user requesting to �su� to the privileged account is allowed to...
(I have done this and its dead easy....Only hassle is that the /etc/profile is over written every time you upgrade the OS. Hence you need to replace the code. I used a one liner to over come this.) I may still have the scripts handy, I did it about 5 years ago.. at one site and it really did the trick.

Install �sudo� and you can start to control who can run what command. And sudo has a log file.

Sudo is available on the net, and there's heaps of info as well.

Incorporate the command checking as outlined in the previous replies posted above.

Andrek

View Public Profile for Andrek

Find all posts by Andrek

9 More Discussions You Might Find Interesting

1. Shell Programming and Scripting

action command

Hi.. When i refered the script /etc/rc.sysinit... i found the "action commands" like But this is not working in my shells.. the following error is coming... Please anybody help Thanks in advance esham

2. UNIX for Advanced & Expert Users

Command Tracking

Hi, OS: Solaris9, SPARC Is there any way I can track the commands run by users from the shell prompt? Example: Somebody is deleting files from the system. Who it is is a mystery. That person obviously does not use bash prompt so there is no history. Is there anyway I can find out who...

3. UNIX for Advanced & Expert Users

Tracking user

dear all, I'm facing problem that is i have noticed from few days back that some body is deleting and making changes in the file from developement server where i'm working(in unix) so i want to track that who is using the server, what performancr they are doing and each every thing which r...

4. UNIX for Advanced & Expert Users

Tracking down the problem

Is there a way to track down what process is sending to a certain port? I have some thing pounding the network with requests to a multicast IP that doesn't exist. I have shut down all comms related processes and yet it is still there. Need a way to track the port or IP back to the process. Thanks...

5. UNIX for Dummies Questions & Answers

Tracking user access

Hi, An important file in my solaris server has been deleted. Is there any way that i can find out when was that file deleted and what user account was used to delete the file..

6. Red Hat

Tracking Process to a particular

I've tried to see what I can find on my own but I'm coming up with goose eggs. Basically I was wondering if there was a way of querying the scheduler (or something similar) to track a process back to a particular CPU it's executing on at the time of the command. ps has a "cpu" output option but...

7. Shell Programming and Scripting

multiple action!

lets explain it easy by showing the initial file and desired file: I've a file such this that contains: initial_file: 31/12/2011 23:46:08 38.6762 43.689 14.16 Ml 3.1 ...

8. HP-UX

Tracking what commands were executed after sudo to another user

All team members has sudo access to user "batch55". Need to track all the commands used by team members after sudo to "batch55". Using HP-UX and ksh shell in our environment. How can i acheive this? Thanks In Advance.

9. Shell Programming and Scripting

How can i TRAP a user Logout action?

When the temp user logs in i see his session as below. # who root pts/0 2017-08-18 08:32 (121.87.51.113) temp pts/1 2017-08-18 09:06 (121.87.51.113) root pts/2 2017-08-18 08:59 (121.87.51.113) When he logs out by either firing exit command or closing the...

LEARN ABOUT REDHAT

groupdel

GROUPDEL(8)						      System Manager's Manual						       GROUPDEL(8)

NAME

       groupdel - Delete a group

SYNOPSIS

       groupdel group

DESCRIPTION

       The groupdel command modifies the system account files, deleting all entries that refer to group.  The named group must exist.

       You must manually check all filesystems to insure that no files remain with the named group as the file group ID.

CAVEATS

       You may not remove the primary group of any existing user.  You must remove the user before you remove the group.

FILES

       /etc/group - group information
       /etc/gshadow - secure group information

SEE ALSO

       chfn(1), chsh(1), passwd(1), groupadd(8), groupmod(8), useradd(8), userdel(8), usermod(8)

AUTHOR

       Julianne Frances Haugh (jockgrrl@ix.netcom.com)

																       GROUPDEL(8)