9 More Discussions You Might Find Interesting
1. UNIX for Beginners Questions & Answers
I want to create a shell script to gather user account information and displays the result to administrator.
I have created a script but its showing all the information when i search for username like:
amit@mx:~$ ./uinfo.sh amit
Username : amit
User Info ... (2 Replies)
Discussion started by: amit1986
2 Replies
2. UNIX for Beginners Questions & Answers
Good afternoon all,
Was un-sure on where to post this so I thought I would use this topic...
I was wondering what best practice people use for the deletion of user profiles on AIX systems?
At the moment, I currently don't delete any user profiles, they are just disabled as they... (1 Reply)
Discussion started by: SteveCPayne
1 Replies
3. AIX
I am trying to find out the information of my local desktop when i use putty to login to an AIX server.
This is what I do:
1. login to my PC
2. take a putty session to an AIX server
Can i get information of my local desktop from the AIX server ? Is there a command available ?
Thanks (8 Replies)
Discussion started by: Nagesh_1985
8 Replies
4. Solaris
Hello,
I was wondering when Solaris auditing is enabled, If it is possible to keep track of users that are allowed to sudo to root. In other words, I would like to know which user did what on my Solaris box. (assumig that user can "sudo su -" )
Thanks. (2 Replies)
Discussion started by: niyazi
2 Replies
5. Shell Programming and Scripting
Hello,
is there some way to track what shell commands some user is executing ?
Something like to have some log file where i could see what commands some user used, e.g. rm -r dirname , ls -l .... and so on ...
I have 2.6.13-1.1526_FC4smp (9 Replies)
Discussion started by: tonijel
9 Replies
6. Shell Programming and Scripting
Hi All,
I need to put in place a UNIX shell script that calls three sql scripts & reports to the DBAs.
I already have the three sql scripts in place & they perform the following database auditing actions:
1. actions.sql
This script queries the DBA_AUDIT _TRAIL table to look for database user... (2 Replies)
Discussion started by: divroro12
2 Replies
7. Solaris
Hello
I have a new job and I need change the last user administrator, I dont know if is easier change some things about this user or add my user in the group with every permission, how can I do it. I dont know which is the group. I think is no only useradd en after modify /etc/passwd.
Tank... (14 Replies)
Discussion started by: cata
14 Replies
8. HP-UX
Hi all
I hope to find what i'm looking for in this forum
as said in the topic i want to track user's actions on the system. i mean also the action of moving or removing files. I have an HP 9000 with HP UX 11i. the users log on the HP from a terminal window under WIndows XP
Thx (3 Replies)
Discussion started by: Timberland
3 Replies
9. AIX
i want to audit user commands ..
keep track of what commands each user has been giving ..
can this be done by writing a script in engraving it in .profile of the user.
or is there any other way of doing this ...
rgds
raj (2 Replies)
Discussion started by: rajesh_149
2 Replies
audit_class(4) File Formats audit_class(4)
NAME
audit_class - audit class definitions
SYNOPSIS
/etc/security/audit_class
DESCRIPTION
/etc/security/audit_class is a user-configurable ASCII system file that stores class definitions used in the audit system. Audit events in
audit_event(4) are mapped to one or more of the defined audit classes. audit_event can be updated in conjunction with changes to
audit_class. See audit_control(4) and audit_user(4) for information about changing the preselection of audit classes in the audit system.
Programs can use the getauclassent(3BSM) routines to access audit class information.
The fields for each class entry are separated by colons. Each class entry is a bitmap and is separated from each other by a newline.
Each entry in the audit_class file has the form:
mask:name:description
The fields are defined as follows:
mask class mask
name class name
description class description
Each class is represented as a bit in the class mask which is an unsigned integer. Thus, there are 32 different classes available. Meta-
classes can also be defined. These are supersets composed of multiple base classes, and thus will have more than 1 bit in its mask. See
Examples. Two special meta-classes are also pre-defined: all, and no.
all Represents a conjunction of all allowed classes, and is provided as a shorthand method of specifying all classes.
no Is the invalid class, and any event mapped solely to this class will not be audited. Turning auditing on to the all meta class will
not cause events mapped solely to the no class to be written to the audit trail. This class is also used to map obsolete events
which are no longer generated. Obsolete events are retained to process old audit trails files.
EXAMPLES
Example 1 Using an audit_class File
The following is an example of an audit_class file:
0x00000000:no:invalid class
0x00000001:fr:file read
0x00000002:fw:file write
0x00000004:fa:file attribute access
0x00000008:fm:file attribute modify
0x00000010:fc:file create
0x00000020:fd:file delete
0x00000040:cl:file close
0x00000100:nt:network
0x00000200:ip:ipc
0x00000400:na:non-attribute
0x00001000:lo:login or logout
0x00004000:ap:application
0x000f0000:ad:old administrative (meta-class)
0x00070000:am:administrative (meta-class)
0x00010000:ss:change system state
0x00020000:as:system-wide administration
0x00040000:ua:user administration
0x00080000:aa:audit utilization
0x00300000:pc:process (meta-class)
0x00100000:ps:process start/stop
0x00200000:pm:process modify
0x20000000:io:ioctl
0x40000000:ex:exec
0x80000000:ot:other
0xffffffff:all:all classes (meta-class)
FILES
/etc/security/audit_class
ATTRIBUTES
See attributes(5) for descriptions of the following attributes:
+-----------------------------+-----------------------------+
| ATTRIBUTE TYPE | ATTRIBUTE VALUE |
+-----------------------------+-----------------------------+
|Interface Stability | See below. |
+-----------------------------+-----------------------------+
The file format stability is Committed. The file content is Uncommitted.
SEE ALSO
bsmconv(1M), au_preselect(3BSM), getauclassent(3BSM), audit_control(4), audit_event(4), audit_user(4), attributes(5)
Part VII, Solaris Auditing, in System Administration Guide: Security Services
NOTES
It is possible to deliberately turn on the no class in the kernel, in which case the audit trail will be flooded with records for the audit
event AUE_NULL.
This functionality is available only if Solaris Auditing has been enabled. See bsmconv(1M) for more information.
SunOS 5.11 26 Jun 2008 audit_class(4)