03-07-2007
Quote:
Originally Posted by jobbyjoseph
At our site(O.S Solaris 5.9) we have disabled the root login and also su . In place of this we have a root equivalent id eg:boss which is basically a copy of ur /usr/bin/su. Now in order to maintain an audit trail of the activities and to restrict root login we have enabled the access of this id only through 1 single id i.e rootload and enabled audit trail using the script command which has been added in the .profile at the very end as detailed below
script is not a suitable auditing mechanism, you should use Solaris auditing instead. If you want to audit shell activity take a look at
this page.
10 More Discussions You Might Find Interesting
1. IP Networking
Hello Guys,
We are using Sco Unix 5.0
While we was changing root password from scoadmin, It did not change the password and hang in between.
Now, I am unable to login as root user
pls. do suggest me how can i skip root password and how can i goto root to change the password again.
Or if... (4 Replies)
Discussion started by: subho77
4 Replies
2. Answers to Frequently Asked Questions
We have quite a few threads about this subject. I have collected some of them and arranged them by the OS which is primarily discussed in the thread. That is because the exact procedure depends on the OS involved. What's more, since you often need to interact with the boot process, the... (0 Replies)
Discussion started by: Perderabo
0 Replies
3. AIX
How do I make it so user "root" can not log directly into an AIX server? I want a user to be able to SU to it but not log into it to keep a log (2 Replies)
Discussion started by: breigner
2 Replies
4. AIX
Hi, yesterday, I changed root's shell in /etc/passwd, cause a mistake then I can not log in root account (can't find correct shell). I attempted to log in single-mode, however, it prompted for single-mode's password then I type root's password but still can not log in.
I'm using AIX 5L version 5.2... (2 Replies)
Discussion started by: neikel
2 Replies
5. HP-UX
With my SSH, my HP-UX cannot login to root. It will come out a message su: unknown id: root. But I can login by user oracle. I also cannot login to console either by using root or oracle anymore. What shall I do. (5 Replies)
Discussion started by: surizan
5 Replies
6. AIX
I can use sudo su to root from my user id through ssh. Also can change root password. However, I cannnot login by root from ssh.
Does any body know why? (10 Replies)
Discussion started by: rainbow_bean
10 Replies
7. UNIX for Dummies Questions & Answers
Hello,
It seems on a machine that I am responsible for supervising only root can use ssh/sftp services. I have looked at sshd_config and do not see anything that can fix this. PermitRootLoggin is enabled but that option does not preclude other users from using ssh/sftp services. When I try and... (5 Replies)
Discussion started by: mojoman
5 Replies
8. UNIX for Dummies Questions & Answers
First timer here... appreciate any help. My lingo might be off a bit, but ill clarify where necessary.
1- Is there a way to monitor direct logins to root? i.e. logging in directly to root as opposed logging in to a user account then su or sudo to root. i have a machine set to "permitrootlogin... (3 Replies)
Discussion started by: Mas000
3 Replies
9. HP-UX
On hp smh i can't login
with root,i type correct unix password
but said "ERROR: Username and password do not match"
Tomcat,apache works
and with debug enabled,nothing said on logs :( (2 Replies)
Discussion started by: Linusolaradm1
2 Replies
10. Red Hat
Hi,
I find there is some customized linux with application.
When I use login account root and type the password.
It is not allow to login.
But if I login with specified user and password.
Then I use command "su - " and type root passwd.
It allow you to switch to "root" account .
Or if i... (14 Replies)
Discussion started by: chuikingman
14 Replies
audit(1M) audit(1M)
NAME
audit - control the behavior of the audit daemon
SYNOPSIS
audit -n | -s | -t | -v [path]
The audit command is the system administrator's interface to maintaining the audit trail. The audit daemon can be notified to read the con-
tents of the audit_control(4) file and re-initialize the current audit directory to the first directory listed in the audit_control file or
to open a new audit file in the current audit directory specified in the audit_control file, as last read by the audit daemon. Reading
audit_control also causes the minfree and plugin configuration lines to be re-read and reset within auditd. The audit daemon can also be
signaled to close the audit trail and disable auditing.
-n Notify the audit daemon to close the current audit file and open a new audit file in the current audit directory.
-s Notify the audit daemon to read the audit control file. The audit daemon stores the information internally. If the audit daemon is
not running but audit has been enabled by means of bsmconv(1M), the audit daemon is started.
-t Direct the audit daemon to close the current audit trail file, disable auditing, and die. Use -s to restart auditing.
-v path Verify the syntax for the audit control file stored in path. The audit command displays an approval message or outputs specific
error messages for each error found.
The audit command will exit with 0 upon success and a positive integer upon failure.
/etc/security/audit_user
/etc/security/audit_control
See attributes(5) for descriptions of the following attributes:
+-----------------------------+-----------------------------+
| ATTRIBUTE TYPE | ATTRIBUTE VALUE |
+-----------------------------+-----------------------------+
|Availability |SUNWcsu |
+-----------------------------+-----------------------------+
|Stability |Evolving |
+-----------------------------+-----------------------------+
bsmconv(1M), praudit(1M), audit(2), audit_control(4), audit_user(4), attributes(5)
The functionality described in this man page is available only if the Basic Security Module (BSM) has been enabled. See bsmconv(1M) for
more information.
The audit command does not modify a process's preselection mask. It functions are limited to the following:
o affects which audit directories are used for audit data storage;
o specifies the minimum free space setting;
o resets the parameters supplied by means of the plugin directive.
For the -s option, audit validates the audit_control syntax and displays an error message if a syntax error is found. If a syntax error
message is displayed, the audit daemon does not re-read audit_control. Because audit_control is processed at boot time, the -v option is
provided to allow syntax checking of an edited copy of audit_control. Using -v, audit exits with 0 if the syntax is correct; otherwise, it
returns a positive integer.
The -v option can be used in any zone, but the -t, -s, and -n options are valid only in local zones and, then, only if the perzone audit
policy is set. See auditd(1M) and auditconfig(1M) for per-zone audit configuration.
25 May 2004 audit(1M)