08-16-2013
Quote:
Originally Posted by
ramky79
Hello,
In our environment some users mess up with the system ( install / uninstall ) software..
unfortunately the root is open to several users (several of them have sudo access)
How to track which user is trying to do this ( I'd like to know which user and what ipaddress. )
Experts please shed some light; how to approach to take control of the situation (systems) and avoid future incidents.
Thanks,
R
Check the authentication log (
/var/log/auth.log). It will tell you who logged in to your server, when, and what he/she did.
Alternatively you can also check their respective history files to see what commands they ran.
10 More Discussions You Might Find Interesting
1. UNIX for Dummies Questions & Answers
hi there,
does anyone know how to kick a telneted user from a the system?
thx (3 Replies)
Discussion started by: crashnburn
3 Replies
2. UNIX for Advanced & Expert Users
The directions below were provided by someone on the unslung mailing list. unslung is a linux OS for LinkSys's $100 NSLU2 NAS controller.
I'm posting the query here because
(1) I think it is really a generic linux/unix questions
(2) I did not get a response in the unslung mailing list.
I... (1 Reply)
Discussion started by: siegfried
1 Replies
3. Solaris
Hi,
I'm new to solaris/ Unix and would like to know how to check in the system what
was the last login user were doing. Is there any way to check this? Thanks in advanced. (1 Reply)
Discussion started by: raziayub
1 Replies
4. UNIX for Advanced & Expert Users
Helo,
I have created one group called RBAC.(roll back access control)
Now when I created user of RBAC its entry in /etc/passwd file is given below:
roleadm:x:120:109:RBAC User:/home/pds_RBAC:/bin/false
I have keep at the end /bin/false because I dont want to give direct login to the user... (2 Replies)
Discussion started by: amitpansuria
2 Replies
5. Solaris
Hi Everybody,
Can somebody tell me the difference between /etc/system and user profile???? (2 Replies)
Discussion started by: tirupathiraju_t
2 Replies
6. Shell Programming and Scripting
Not sure if that title is decent, but here we go. I'm running this string of commands:
qstat -f $1 | sed 's/^*//' | sed -n -e ":a" -e "$ s/\n//gp;N;b a" | sed 's/\\,/,/' | awk -F"PBS_O_WORKDIR=" '{print $2}' | awk -F",PBS_O_SYSTEM" '{print $1}'In case you're curious is takes the output of a PBS... (3 Replies)
Discussion started by: dhibbit
3 Replies
7. Shell Programming and Scripting
Does anybody know how to keep SCCS from changing the wrong module keywords? I'm thinking of a don't translate after this line kind of operation.
I see where you can use get with a -k but then no keywords get translated. It's either all or none.
I use simply
# %A%
# %G% %T%
in all my... (1 Reply)
Discussion started by: Back-N-Black
1 Replies
8. Programming
Hello,
I'm implementing a very simple FTP client, and to do the login I would like to check against system users instead of using my own database, so that I can give the proper permissions to the newly created process that I spawn with fork. What's the best way for doing this in C?
I've read... (4 Replies)
Discussion started by: royger
4 Replies
9. Shell Programming and Scripting
i am prompting for a name to search.
read user
if
then
however, i get this error:
please enter a username on the system:
fool
menu_script2.sh: line 123: (4 Replies)
Discussion started by: icelated
4 Replies
10. IP Networking
I noticed my hostname is <my-full-name>s-macbook.local. I'm not sure exactly what information leaves the local network, and whether the hostname is included, but if it is, this would mean people on the Internet can look at my hostname and see who I am. Before anyone says that's not possible,... (4 Replies)
Discussion started by: Ultrix
4 Replies
LEARN ABOUT REDHAT
pam_console
pam_console(8) System Administrator's Manual pam_console(8)
NAME
pam_console - control permissions for users at the system console
SYNOPSIS
session optional /lib/security/pam_console.so
auth required /lib/security/pam_console.so
DESCRIPTION
pam_console.so is designed to give users at the physical console (virtual terminals and local xdm-managed X sessions by default, but that
is configurable) capabilities that they would not otherwise have, and to take those capabilities away when the are no longer logged in at
the console. It provides two main kinds of capabilities: file permissions and authentication.
When a user logs in at the console and no other user is currently logged in at the console, pam_console.so will change permissions and own-
ership of files as described in the file /etc/security/console.perms. That user may then log in on other terminals that are considered
part of the console, and as long as the user is still logged in at any one of those terminals, that user will own those devices. When the
user logs out of the last terminal, the console may be taken by the next user to log in. Other users who have logged in at the console
during the time that the first user was logged in will not be given ownership of the devices unless they log in on one of the terminals;
having done so on any one terminal, the next user will own those devices until he or she has logged out of every terminal that is part of
the physical console. Then the race can start for the next user. In practice, this is not a problem; the physical console is not gener-
ally in use by many people at the same time, and pam_console.so just tries to do the right thing in weird cases.
ARGUMENTS
debug turns on debugging
allow_nonroot_tty
gain console locks and change permissions even if the TTY's owner is not root.
permsfile=filename
tells pam_console.so to get its permissions database from a different file than /etc/security/console.perms
fstab=filename
tells pam_console.so to read the table of configured filesystems from a file other than /etc/fstab when scanning permsfile. This
file is used to map directories to device names.
FILES
/var/run/console.lock
/var/run/console/
/etc/security/console.apps
/etc/security/console.perms
SEE ALSO
console.perms(5)
console.apps(5)
/usr/doc/pam*/html/index.html pam_console_apply(8)
/usr/doc/pam*/html/index.html
BUGS
Let's hope not, but if you find any, please report them via the "Bug Track" link at http://bugzilla.redhat.com/bugzilla/
AUTHOR
Michael K. Johnson <johnsonm@redhat.com>
Red Hat 2000/7/11 pam_console(8)