05-19-2016
You could try a number of tweaks, such as:-
- On login, set the command history file to one based on the connecting IP address
- Collect all commands issued by a tty session and write them to the syslog, including the connecting IP address
- Intercept the kill command with a script that logs the process id and details of the process before calling the real kill command
- Some other variation?
Of course, all of these can bypassed, but they might give you a clue if someone forgets. The best method is to set up separate accounts for each user so that they cannot do this in the first place. You are exposing yourself to untold horrors from mistakes and malicious attack.
Is there a good reason for not having separate user accounts, or is it just 'easy'. Remember that security is like contraception - people may not like it but the cost of mistakes can be enormous.
I hope that the above suggestions may help,
Robin
10 More Discussions You Might Find Interesting
1. Shell Programming and Scripting
Hi,
I want to execute a script - of different user from my script.
I have tried the su command
su - username -c "scriptname"
it works but asked for password.
Is there any way for supplying the password to it thru script, not interactively.
Or is there any other way to achieve the... (5 Replies)
Discussion started by: yeheyaansari
5 Replies
2. UNIX for Dummies Questions & Answers
How do i in a script determine the user that is executing it? (2 Replies)
Discussion started by: Chiefos
2 Replies
3. UNIX for Dummies Questions & Answers
Hi,
I need to execute the following unix command through my java code -
zip -e
When i execute this command from the command prompt, i am prompted for a password in the following manner -
Enter password:
Verify password:
Is it possible to provide the password inthe first command itself... (5 Replies)
Discussion started by: jacob23
5 Replies
4. UNIX for Dummies Questions & Answers
I have two machines, one running Windows and another one Unix over a network. I want to execute a batch file on the Windows machine using a script running on the Unix machine.
I have tried creating a rsa key and transferrring it to the destination machine but it doesn't work. The purpose was to... (3 Replies)
Discussion started by: MobileUser
3 Replies
5. UNIX for Dummies Questions & Answers
When trying to find a list of files with specific text in them using
find . -type f -exec grep -l "DataStage Job 4263" {}\;
I get error
find: missing argument to 'exec'
How can I correct this ? I'm on Linux Red Hat.
Cheers
PS I'm a DataStage programmer not a systems support... (4 Replies)
Discussion started by: jackdaw_at_work
4 Replies
6. UNIX for Advanced & Expert Users
Hi all,
Just need some help the following scenario,
Is there any UNIX command to find the unix machine type (like whether the machine is belongs to Ssun ultra 45 type) like that .. please help me (2 Replies)
Discussion started by: abhisheksunkari
2 Replies
7. Shell Programming and Scripting
Hi All,
i have two machines like x and y . my requirement is i should connect to machine Y from x through ssh connection . and do some operation such as copy and move and delete files in Y machine .
i tried with this code but it is doing in machine x only . and i need to exit from Y when... (1 Reply)
Discussion started by: rateeshkumar
1 Replies
8. UNIX for Dummies Questions & Answers
Buddies, I am trying to copy the file 'xcopyq' from /home/sandip to /home/sandip/testdir using the below command and getting the error as shown below:-
sandip@manu:~$ find /home/sandip -type f -name '*xcopyq*' -exec cp{} /home/sandip/testdir/ \:
find: missing argument to `-exec'
Am I... (2 Replies)
Discussion started by: sandip250382
2 Replies
9. Shell Programming and Scripting
Running below command , but unable to print the filename , is there way to print filename/dirname using -print option
find . -type f -exec aclput -i fileacl.template {} \; (5 Replies)
Discussion started by: lalitpct
5 Replies
10. UNIX for Dummies Questions & Answers
hi
how to restrict a user ro run rm command.
In this scenario we have a user/group has below in sudoers
user ALL=(ALL) ALLis there a way to restrict the user from just executing rm command (9 Replies)
Discussion started by: robo
9 Replies
LEARN ABOUT OPENSOLARIS
netrc
netrc(4) File Formats netrc(4)
NAME
netrc - file for ftp remote login data
DESCRIPTION
The .netrc file contains data for logging in to a remote host over the network for file transfers by ftp(1). This file resides in the
user's home directory on the machine initiating the file transfer. Its permissions should be set to disallow read access by group and oth-
ers. See chmod(1).
Tokens can be separated by SPACE, TAB, or NEWLINE characters. The following tokens are supported:
account string Supply an additional account password. If this token is present, the auto-login process supplies the specified string if
the remote server requires an additional account password. If the remote server does not require an additional account
password, the auto-login process initiates an ACCT command.
default Same as machine name, except that default matches any name. There can be only one default token, and it must be after
all machine tokens. The default token is normally used as follows:
default login anonymous password user@site
Such an entry gives the user automatic anonymous ftp login to machines not specified in .netrc.
login name Identify a user on the remote machine. If this token is present, the auto-login process initiates a login using the
specified name.
machine name Identify a remote machine name. The auto-login process searches the .netrc file for a machine token that matches the
remote machine specified on the ftp command line or as an open command argument. Once a match is made, the subsequent
.netrc tokens are processed, stopping when the EOF is reached or another machine token is encountered.
macdef name Define a macro. This token functions the same as ftp macdef. A macro is defined with the specified name; its contents
begin with the next .netrc line and continue until a null line (consecutive NEWLINE characters) is encountered. If a
macro named init is defined, it is automatically executed as the last step in the auto-login process.
password string Supply a password. If this token is present, the auto-login process supplies the specified string if the remote server
requires a password as part of the login process. If this token is present in the .netrc file, ftp aborts the auto-login
process if the .netrc is readable by anyone besides the user.
skipsyst Skip the SYST command that is sent by default to all remote servers upon connection. The system command is what enables
the automatic use of binary mode rather than the protocol default ascii mode.
As some older servers cannot handle the ftp command, this directive is provided to allow inter-operability with these
servers.
EXAMPLES
Example 1 A Sample .netrc File
A .netrc file containing the following line:
machine ray login demo password mypassword
allows an autologin to the machine ray using the login name demo with password mypassword.
FILES
~/.netrc
SEE ALSO
chmod(1), ftp(1), in.ftpd(1M)
SunOS 5.11 25 Aug 2006 netrc(4)