Visit Our UNIX and Linux User Community


How do i find all the commands entered by root on any terminal


 
Thread Tools Search this Thread
Special Forums Cybersecurity How do i find all the commands entered by root on any terminal
# 1  
Old 10-19-2008
Data How do i find all the commands entered by root on any terminal

Can any one help me with a script, which runs in background and mails me all the commands entered by root on any terminal for every hour. We have multiple people having root access on the server and creating a mess,i just wanted to monitor all the activity of the root.
# 2  
Old 10-19-2008
You won't be able to do it at the scripting level unfortunately unless you already have a mechanism in place to capture the commands and just want to automate the transfer of them.

In order to really get a handle on keeping watch over your admins with root access, you'll need to hook into something at a much lower level. Solaris has a set of tools called the BSM (Basic(?) Security Module I think) which will allow you to get right down to the individual system calls if you want. Other OS's will likely have similar options avialable to them too. Post your OS here and with a little luck someone will be able to identify what you'll need to look at to get this going.

Another option is to look at tools like tripwire and remote syslog servers - catch the end result of the commands rather than the commands themselves. Provided everything is logged realtime to a remote server that the users in question do not have access to, you can review what they've done. Just remember to have them sign something to promise they won't turn off the logging and immediatly terminate the employment of anyone that breaks this (you will see it disable even if you can't see what happens afterwards).

Yet another option (and my preference) is to cut back the access. Use sudo to grant specific sets of commands to specific groups of users. Use file permissions to grant read-only access to users that only need that. Use setuid menus to provide for the use of more complex programs while retaining logging of what is being done.

I am one of the two senior engineers responsible for over a hundred servers and I don't know the root password to any of my boxen. It's not actually that tough to set up a three-way model to keep your access control, audit, and admin work seperate. You can't prevent someone playing silly-buggers but you can certainly catch them Smilie
# 3  
Old 10-20-2008
The main problem is we have a application testing team and couple of guys have the root access and they think they are admins....unfortunately i am from the unix team who had to support the servers used by testing team. The funniest part is they don't want to use sudo, and i have to cleanup the mess created by them every time.

I thought it would be a great idea to capture the input from standard input,whenever anybody logs in as root.

Iam trying to convince them to loose direct root access and use sudo....but these buggersSmilie dont seem to agree with me.
# 4  
Old 10-20-2008
Smilie You can set the default login shell as Bash. Smilie
This shell is having the tool known as History. Smilie
Anyone logged with this shell if execute any command then that command will get stored and appended to /.bash_history file.
You can make a script which will mail you the contents of /.bash_history
at your will and you will have all commands executed by root with
you...... Smilie

Hope this will help..... Smilie
# 5  
Old 10-20-2008
Quote:
Originally Posted by Reboot
Smilie You can set the default login shell as Bash. Smilie
This shell is having the tool known as History. Smilie
Anyone logged with this shell if execute any command then that command will get stored and appended to /.bash_history file.
You can make a script which will mail you the contents of /.bash_history
at your will and you will have all commands executed by root with
you...... Smilie
Ah, but what happens if you have two people logged in as root at the same time? It would be a bit tough to distinguish one session from another...

I suppose you could use 'script "/some/log/dir`who am i | awk '{ print $1 }'`-`date`"' ...

As for moving the users over to another access model, set up the 'new way' and show the users. You can reassure them that they will retain their su rights to root for now to give them a chance to evaluate the new method. Watch the sulog file and contact the person each time they use su to ask what they tried to do via sudo but couldn't. You can then fix whatever it was (or remind them that the access will be taken away and they should be finidng all the issues before it's too late).
Once you have all the problems cleared up, change the password to something only you know.

If you meet resistance, talk to your risk team and show them the very big risk involved in having more than one person able to do work as root without being able to trace who did what. Risk guys hate being unable to trace things back to a single person.
# 6  
Old 10-21-2008
Hi.. Smiling Dragon You are right...... Smilie
It would be a bit tough to distinguish one session from another when two people logged in as root at the same time....Smilie

So, for that I have a solution......
First make Sure that you have sufficient space in / then do following :

1. Make a directory /record.
2. Put following entries in /.bashrc file:
x=`tty | cut -c 6- |tr '[/]' '[.]'`
if [ ! -d /record ] ; then
mkdir -p /record
fi
if [ ! -f /record/$x ] ; then
touch /record/$x
fi
echo >> /record/$x
echo " *********************************** " >> /record/$x
echo >> /record/$x
script -a /record/$x

Now, when anyone will log in to the system each time you are going to get his commands recorded to /record/pts.# file along with time and date of login. Where "#" is the terminal number given by tty command.The commands will get appended to this file (not over written).

So, you will have to monitor these files in /record directory regularlly so as to limit their size and growth.
No doubt you will have to set default shell as Bash.

Hope this will help..... Smilie

Cheers.... Smilie......Smilie

Last edited by Reboot; 10-21-2008 at 06:56 PM..
# 7  
Old 10-24-2008
Hi Reboot,
for some reason when I use script (/usr/bin/script) in .bashrc, as soon as the user logs in the shell goes crazy (e.g. CPU 100%) and the output file - typescript in my case - becomes huge. Do you know why?
The command 'script' on a command line works just fine, it's the .bashrc that doesn't like it. I am using Debian Etch.

Previous Thread | Next Thread

10 More Discussions You Might Find Interesting

1. Shell Programming and Scripting

Find users with root UID or GID or root home

I need to list users in /etc/passwd with root's GID or UID or /root as home directory If we have these entries in /etc/passwd root:x:0:0:root:/root:/bin/bash rootgooduser1:x:100:100::/home/gooduser1:/bin/bash baduser1:x:0:300::/home/baduser1:/bin/bash... (6 Replies)
Discussion started by: anil510
6 Replies

2. Ubuntu

Creating terminal commands

I've written a program in C, called count_0.1 which is essentially a word count program. I want to be able to use it as a command in the terminal (by typing in count), like when you type in ls, you don't have to go to a directory, find an executable and type in: ./ls I've tried: Adding... (1 Reply)
Discussion started by: usernamer
1 Replies

3. Programming

C terminal commands

Hi I am trying to modify a C program to work for my needs. Problem is I don't know any real programming. I would really appreciate it if someone could help me! Basically it is to get bandwidth speeds from a remote box. I have two terminal commands that get me the up and down speeds. So how do... (8 Replies)
Discussion started by: milestails
8 Replies

4. Shell Programming and Scripting

find files for next day of the date entered

i have few files generated everyday with a date stamp. Sometimes it happens that if the files are generated late i.e after 00:00 hrs the date stamp will be of the next day. example: 110123_file1 110123_file2 110123_file3 110124_file4 in the above example file4 is also for the previous... (2 Replies)
Discussion started by: gpk_newbie
2 Replies

5. UNIX for Dummies Questions & Answers

help with simple terminal commands

i am at home with a windows xp home, and i am using putty terminal to access my linux mathlab account, my task is to compile and run a C program, called a.c, i used gcc -Wall -g -o mycode a.c to compile it into a mycode file now when i want to run it, i was told i had to use $... (2 Replies)
Discussion started by: omega666
2 Replies

6. Shell Programming and Scripting

commands in the terminal

hi.. I have a small question...if I have a textfile..let say apple.txt and I want to 1. search for all strings that's 6 characters long, and contains the letters a,b,c,d. 2. search for all words that that begins with "sUn" and ends with "flower" 3. search for all the words beginning with the... (3 Replies)
Discussion started by: Oregano
3 Replies

7. UNIX for Dummies Questions & Answers

How to allow access to some commands having root privleges to be run bu non root user

hi i am new to unix and i have abig task. i have to \run particular commands having root privileges from a non root user. i know sudo is one of the way but i need sum other approach kindly help Thanks (5 Replies)
Discussion started by: suryashikha
5 Replies

8. AIX

Can't login root account due to can't find root shell

Hi, yesterday, I changed root's shell in /etc/passwd, cause a mistake then I can not log in root account (can't find correct shell). I attempted to log in single-mode, however, it prompted for single-mode's password then I type root's password but still can not log in. I'm using AIX 5L version 5.2... (2 Replies)
Discussion started by: neikel
2 Replies

9. Solaris

How to allow root login from a specified terminal ?

I want to enable root login just from one terminal machine, can i do that via /etc/default/login in console=/dev/console line ? and if so what i have to type exactly, another question is it normal to edit the files inside defaults directly ? or i can copy it to /etc/ and edit it there and its... (3 Replies)
Discussion started by: XP_2600
3 Replies

10. UNIX for Dummies Questions & Answers

Terminal Commands

Hi there. Linux newbie and I'm trying to find commands to: Display number of executable files in a directory that i supply and list them in alphabetical order Back up all the files in the current irectory to a directory i supply, creating that directory if it's not allready there Cound... (5 Replies)
Discussion started by: indigoecho
5 Replies

Featured Tech Videos