Please let me how to enable user specific audit in Linux server.
Say i have specific user namely admin1,admin2,admin3 apart from the normal users, user1,2,3.....userN.
How to enable audit for users admin1,admin2 and admin3 alone.
Also please let me know, if this would have any overload on the server.
Is the overload negligible.
Thanks a lot,
Pradeep.
Last edited by pradebban; 11-30-2011 at 05:20 AM..
Reason: Grammer check :)
Strong suggestion - use sudo and /etc/sudoers. Lock any direct login access.
For solaris folks reading this: use /etc/user_attr and the associated tools.
This provides you with a lot more control: you set up who can get into admin1, and lets you log everything, for example with script. If the user exits from the script process, the session ends. You can also control what those user accounts can and cannot do.
script usage in .profile :
This is not perfect, but is a decent start without invoking a whole lot of accounting.
There are also good keyloggers out there, but if you have someone trying to dodge security, by getting around key-logging or script, then you are crazy to have given them sudo access to admin in the first place.
I need to audit which user (with ip) has logged in and what files have he edited/deleted. This is available as a part of unix, but it enables the logs for all users, which i need to edit for only certain users.
There are a few commercial solutions that provide this functionality. One of them is ObserveIT for unix it provides auditing both at the resource level such as files etc.. as well as at the keylogging level such as SSH and telnet. With ObserveIT you can also set auditing rules per user, server, and command.
Need some help in coming up to log all the activity that is used with our common "unix account".
Ideally I am looking for to log the activity in a "separate" file for each session or login until the user logout, I would like to capture the date/time and terminal login and record all the ... (3 Replies)
Dear All
I have a old system run in Red hat Linux 9..
And if it's possible, I want to install the audit rpm package in the Red hat Linux 9.
But I can't find the audit-*.rpm file in the Red hat Linux 9's CD..?
Can any help me to conform Red hat Linux 9 doesn't support audit?
Any... (0 Replies)
Dear All
When I start the AIX(6100-06)audit subsystem.
the log will save in /audit/stream.out (or /audit/trail), but in default when /audit/stream.out to grow up to 150MB.
It will replace the original /audit/stream.out (or /audit/trail).
Then the /audit/stream.out become empty and... (2 Replies)
Hi,
I keep encountering events in the BSM/C2 logs which shows that the audit-user who performed the event is the user (e.g. ongkk in the example below). However, the user is able to show me that he wasn't logged in at that time nor have the rights to perform the event (e.g. su in this example).... (5 Replies)
Hi,
I wish to audit access to a specific folder or file in Solaris.
I have read the man pages for auditd, audit_control , audit_event but don't seem to find any clue.
Has anyone tried this before ? Is it feasible ?
Any advise is appreciated.
Thanks
Yik (5 Replies)
Hi,
I would like to know if there is anyway that I can pinpoint the user before/after he connects to the root? Also, I'm trying to find out what are the commands he inputs under root access. (6 Replies)
Hi,
I have been asked if it is possible to track the last time a specific user logged in to the sysetm.
checked my documentation but can't see it there - google is not being very helpful either.
I wonder if someone here can help - it will be much appreciated.
Thanks
Suresh (1 Reply)