Linux audits in syslog, any time a user is deleted or added. However, I'm running a Solaris11 VM, and find no such entries. How can I enable auditing for useradd and userdel? Oracle's documentation on managing the auditing service, has been of no assistance. Thanks.
# grep useradd /var/log/*
grep: /var/log/anaconda: Is a directory
grep: /var/log/audit: Is a directory
grep: /var/log/chrony: Is a directory
grep: /var/log/httpd: Is a directory
grep: /var/log/mariadb: Is a directory
grep: /var/log/qemu-ga: Is a directory
grep: /var/log/rhsm: Is a directory
grep: /var/log/sa: Is a directory
/var/log/secure-20180522:May 15 17:33:41 centos7host useradd[1054]: new user: name=apache, UID=48, GID=48, home=/usr/share/httpd, shell=/sbin/nologin
/var/log/secure-20180522:May 15 17:50:10 centos7host useradd[1387]: new user: name=mysql, UID=27, GID=27, home=/var/lib/mysql, shell=/sbin/nologin
/var/log/secure-20180522:May 15 18:16:19 centos7host useradd[5588]: new group: name=nagios, GID=1002
/var/log/secure-20180522:May 15 18:16:19 centos7host useradd[5588]: new user: name=nagios, UID=1001, GID=1002, home=/home/nagios, shell=/bin/bash
I just want to audit and log to syslog when a user is added, removed or modified from the system.
According to the docs I have:
#/etc/security/audit_control
dir:/var/audit
flags:ua
minfree:20
naflags:ua
plugin:name=audit_syslog.so.1; p_flags=ua
But neither syslog nor auditreduce -c ua... (7 Replies)
Hi Friends
I am a Solaries newbie and I am looking out for a software or command or config that can capture all commands run by all users on a server on a daily basis. I believe that this Audit is being done in almost all enterprises and would like to know how the same is done there.
Any... (3 Replies)
Hi,
I have installed Solaris 10 in my PC and now installing Oracle10, but while adding a user i am getting following error:
useradd -g oinstall -G dba -d /export/home/oracle oracle
UX: useradd: ERROR: Inconsistent password files. See pwconv(1M).
I have tried pwconv command,... (4 Replies)
Good day all.
I'm trying to add a user with useradd and the -p option to assign a project name, but the result is that the user is created with an error message: "UX: useradd: user.root name should be all lower case or numeric."
The command:
useradd -d /export/home/tester -g rtpgrp -G... (2 Replies)
I installed Solaris 10 (8/11) and added an account for myself. It lives in
/export/home/{name} but /etc/passwd shows it is
/home/{name} where it seems to be mounted like a filesystem. I tried to
create another account from the command line but it doesn't work the same way.
I can't find... (7 Replies)
Dear All,
I have one of my Servers, running Solaris 9. I wanna enable the Audit log enabling, the way I did in Solaris 10 Servers.
After running, the bsmconv script, giving the reboots, modifying all the audit files in /etc/security, the audit is enabled, but the audit file which shall be... (3 Replies)
hi,
I enabled bsm modules (/etc/security/bsmconv) and rebooted Solaris 10. But service is going into maintenance state. I rebooted server and I see one error saying "sys/c2audit:audit_kssl() not defined properly". I am not sure, what it is indicating and how it should be fixed. Please suggest, how... (5 Replies)
Discussion started by: solaris_1977
5 Replies
LEARN ABOUT REDHAT
userdel
USERDEL(8) System Manager's Manual USERDEL(8)NAME
userdel - Delete a user account and related files
SYNOPSIS
userdel [-r] login
DESCRIPTION
The userdel command modifies the system account files, deleting all entries that refer to login. The named user must exist. The options
which apply to the userdel command are:
-r Files in the user's home directory will be removed along with the home directory itself and the user's mail spool. Files located in
other file systems will have to be searched for and deleted manually.
FILES
/etc/passwd - user account information
/etc/shadow - secure user account information
/etc/group - group information
CAVEATS
userdel will not allow you to remove an account if the user is currently logged in. You must kill any running processes which belong to an
account that you are deleting. You may not remove any NIS attributes on an NIS client. This must be performed on the NIS server.
SEE ALSO chfn(1), chsh(1), passwd(1), groupadd(8), groupdel(8), groupmod(8), useradd(8), usermod(8)AUTHOR
Julianne Frances Haugh (jockgrrl@ix.netcom.com)
USERDEL(8)