Is there a way to find when a user is added in Linux host? Post: 302886867

Sponsored Content

Top Forums Shell Programming and Scripting Is there a way to find when a user is added in Linux host? Post 302886867 by rbatte1 on Tuesday 4th of February 2014 05:12:26 AM

02-04-2014

Moderator

I renamed the executables for useradd, usermod, userdel, passwd, etc. to have suffix .supplied. I then created a script /usr/bin/audit_logger with the below:-

Code:

#!/bin/ksh
# This interceptor script simply logs usage to syslog and the return code
#
# The original command is then passed through to the saved version

who am i | read userid PTS rest
/usr/bin/logger "on $PTS as `id -un` running \"$0 $@\""
echo "`date` : $userid as `id -un` running \"$0 $@\"" >> /sec/auditlog
$0.supplied "$@"
RC=$?
/usr/bin/logger "on $PTS as `id -un` finished \"$0 $@\" RC=$RC"
echo "`date` : $userid as `id -un` finished \"$0 $@\" RC=$RC" >> /sec/auditlog
exit $RC

When hard-linked to replace the original names, this writes messages to the syslog and off to the remote syslog collector because we have an entry in /etc/syslog.conf (or /etc/rsyslog.conf)

Code:

*.debug           @aaa.bbb.ccc.ddd               # Sends all debug to syslog collector at IP address

I hope that this is useful. It's not too clever, and you will need to check that it is kept in place. It writes to the syslog with the logger command, but because this can be lost when it gets to your normal limits, we have a permanent log file locally too in /sec/auditlog.

As we have recently outsourced our user admin, this is invaluable to tracing what they are doing and why and can be audited to trace back to authorised requests. It's not our preference, but dictated by our parent company, yet we still retain the legal responsibility for the servers and the protection of the sensitive personal and financial data they contain.

The security admin staff are trapped in simple menus to keep them away from the command line.

We have this on AIX, HP-UX & RHEL. If you don't have ksh I'm sure that the conversion to bash will be pretty simple.

Robin

rbatte1

View Public Profile for rbatte1

Visit rbatte1's homepage!

Find all posts by rbatte1

9 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

how to find the host name

HI, what is the command to find the host name with IP address. is possible to find the host name of other boxes( having their ip) from the same box (assuming telnet to other box is possible from this) Regards, Ananda

2. UNIX for Dummies Questions & Answers

How many user can be added to single group

Hi There, How many user can be added to a unix single group. I need this for unix and solaris. BRs -----Post Update----- I'm asking about secondary group and not primary group. All the users are having 8 character as their username. value is set for getconf LINE_MAX is...

3. UNIX for Dummies Questions & Answers

change user> to user@host> ssh prompt

Hi, I was wondering how to change the prompt for my ssh login. At the moment it is like user> while I'd like it to be as user@host> It is in the .bash_profile or .ssh ??? Thanks

4. UNIX for Advanced & Expert Users

Help! How to find the local host after few ssh hops to remote host???

I do a ssh to remote host(A1) from local host(L1). I then ssh to another remote(A2) from A1. When I do a who -m from A2, I see the "connected from" as "A1". => who -m userid pts/2 2010-03-27 08:47 (A1) I want to identify who is the local host who initiated the connection to...

5. HP-UX

How can I find the size of files added to a folder after a particular date

Hi, I want to find the size of the files added to a folder after a certain date(say 1st of october), I know we can list the files which were created after a certain date , but is there anyway to find the total size of those files ?

6. UNIX for Dummies Questions & Answers

Host file per user

Is anyone aware of a way of creating a local hosts file for a user? Getting a change made to /etc/hosts by our administrators takes about 4 weeks and a ridiculous amount of form filling for such a simple task, so was hoping I could have a locally controlled one for my user. Is such a thing...

7. Solaris

Why this message came when i added user in group?

Hi all, When I added one user in in this group hhs_gl6 following message got generated. -bash-3.00$ /usr/local/bin/sudo /usr/sbin/usermod -G hhs_gl6 vivek UX: /usr/sbin/usermod: hhs_gl6 name should be all lower case or numeric. However when I cheked the user in /etc/group file, the...

8. Red Hat

How to find which host a VM is running on?

We have quite a few Linux VMs running (several hundred). Some are running in VMware and some are running on Citrix XenServer. I know that it is possible, for example, to go into vSphere and search for the host name. But there are times where it is not found for whatever reason and I want to log...

9. Linux

Mount a newly added LUN on a GNU/Linux distro

Hi I am not familiar with the linux, but I was asked to create a file system on a LUN from the NetApp that was mapped to the linux server. The server is runing: uname -a Linux localhost.localdomain 2.6.18-92.el5 #1 SMP Tue Apr 29 13:16:15 EDT 2008 x86_64 x86_64 x86_64 GNU/Linux and now...

LEARN ABOUT DEBIAN

mysqmail-courier-logger

mysqmail-logger(8)					      System Manager's Manual						mysqmail-logger(8)

NAME

       mysqmail-courier-logger - logs courier-imap traffic to a mysql database

SYNOPSIS

       mysqmail-courier-logger subprogram [ args ...  ]

DESCRIPTION

       mysqmail-courier-logger reads the syslog using tail -F, and for each dovecot lines of POP3 and IMAP corresponding to a disconnection, mysq-
       mail-courier-logger writes the total used bandwidth corresponding to the username. Configuration is read from /etc/mysqmail.conf.

       mysqmail-courier-logger uses a table corresponding to this one:

       CREATE TABLE IF NOT EXISTS pop_access (
	 id varchar(32) NOT NULL default '',
	 uid int(11) NOT NULL default '65534',
	 gid int(11) NOT NULL default '65534',
	 home varchar(255) NOT NULL default '',
	 shell varchar(255) NOT NULL default '',
	 mbox_host varchar(120) NOT NULL default '',
	 crypt varchar(50) NOT NULL default '',
	 passwd varchar(50) NOT NULL default '',
	 active int(11) NOT NULL default '1',
	 start_date date NOT NULL default '0000-00-00',
	 expire_date date NOT NULL default '0000-00-00',
	 quota_size int(11) NOT NULL default '0',
	 type varchar(20) NOT NULL default 'default',
	 memo text,du bigint(20) NOT NULL default '0',
	 another_perso varchar(5) NOT NULL default 'no',
	 redirect1 varchar(255) default NULL,
	 redirect2 varchar(255) default NULL,
	 localdeliver varchar(10) NOT NULL default 'yes',
	 pop3_login_count int(9) NOT NULL default '0',
	 pop3_transfered_bytes int(14) NOT NULL default '0',
	 imap_login_count int(9) NOT NULL default '0',
	 imap_transfered_bytes int(14) NOT NULL default '0',
	 last_login int(14) NOT NULL default '0',
	 PRIMARY KEY  (id,mbox_host) ) TYPE=MyISAM

       To have mysqmail-courier-logger working, you should have issued	mkfifo	/var/log/courier.fifo  to  create  the	fifo  and  use	nohup  cat
       /var/log/courier.fifo | /usr/bin/mysqmail-courier-logger > /dev/null 2>&1 & to launch it.

VERSION

       This documentation describes mysqmail-courier-logger version 0.1.4.  See http://gplhost.com/softwares-mysqmail.html for updates.

SEE ALSO

       qmail-send(3), syslog(3), logger(8)

																mysqmail-logger(8)