Visit Our UNIX and Linux User Community


Command History for a user with IP details


 
Thread Tools Search this Thread
Operating Systems Solaris Command History for a user with IP details
# 1  
Old 08-25-2009
Command History for a user with IP details

Hi
We are sharing our envoirnment with our component teams. the plateform is SunOS 5.8 Generic_117350-41 sun4u sparc SUNW,Sun-Fire-V490.

All team logs in the domain with same user and perform activities.
Now for the system auditing purpose can somebody guide me how can I get the details when a user fired a particular command and from which IP. Like if somebody fires a command rm <filename> I want to see the date when command was fired, username who fired the command and the IP address of the system who fired the command so that I can hunt him down. I google a lot on this subject and on some webpage it was suggested that Solaris logging can be enable for a user. But hoe\w I can be done I was not able to get. Can somebody please help me here. I have root access on this machine.

Regards
Sukhvinder Singh
# 2  
Old 08-25-2009
We'll set aside the usual rant that should incur for the sake of getting to the useful bit right away, just just take it as given that I don't approve of shared accounts for an initial connection to a server Smilie

Give the users their own personal login, then grant them rights to switch to the user they all use for the various activities they need to do - that way you have an ID associated with each session.
Then, to get more detail than just "user blah became root at timeX" you could turn on Solaris Auditing (aka BSM).

Without that, about the best you can do is see which IP address was connected during the time the command you are attempting to trace occurred. That's often insufficient if there are a lot of users on.
# 3  
Old 08-27-2009
Well the same thing we are doing as you have suggested. We have provided them a login id. after than they switch to root and then to our user as there user is not permitted to change in our directory and then they do the changes.
I can get the details of this from sulogs but I want to know what commands they fired after they switched with time and date as history command is not showing these details.
# 4  
Old 08-27-2009
History is very easily modified my the user anyway so isn't really useful.
If you already have an audit trail of their arrival and the associated pty, then it's just a matter of using BSM / Audit to track what they do from there. There's _heaps_ of info available on Solaris' audit daemon, along with a number of tools (free or licensed) to interpret the screeds of data you get from it Smilie

As an alternative, you could identify the exact commands the user needs and just grant sudo rights to those commands as the target user only. Then it's logged and a lot safer too.
# 5  
Old 12-18-2009
Smiling Dragon
Can you please let me know how can I use BSM/Audit Track to hunt down the culprit IP address. Also let me know any free tool avaialble to keep an eye on a operater using the shared login username operating from a terminal. I want to get commands fired by each user operating from different machines but using same username (simply because we operate as a team).

Regards
Sukhvinder Singh
Tech Mahindra Ltd.
# 6  
Old 12-18-2009
you have to create the /var/adm/loginlog file to log users connection. this should have been done during the OS hardening (/var/log/syslog.conf). each user's .bash_history file logs the history of commands executed. whenever a user logs in, use the script command to record the actities to a file.
For eg. try this so that you can see.
Login to system
type:-
cd /
script /tmp/rec_cmds
do whatever you want , useradd , del file, housekeep or run scripts etc
crtl+D

cat /tmp/rec_cmds <-- shows you what had just happened
# 7  
Old 12-21-2009
As previously stated, you use BSM/audit to track what they do on the system, not track down the IP.
But you can associate the IP to the pty then associate the actions with that pty.

BSM is a Solaris builtin that can be enabled to log whatever info you wish, right down to the system calls.

Previous Thread | Next Thread
Test Your Knowledge in Computers #773
Difficulty: Medium
A finite-state machine (FSM) is a specialized computer developed by AT&T.
True or False?

10 More Discussions You Might Find Interesting

1. UNIX for Advanced & Expert Users

Fc command does not display all commands history of a user

hi, i have an AIX6.1 machine and i modified a user's profile so that it creates history file for each ip address that connects with this user. the reason i did this is because more than 1 person connects with the same user so i want to keep track of command run by all of them. therefore, in the... (5 Replies)
Discussion started by: omonoiatis9
5 Replies

2. Shell Programming and Scripting

Script to append user details as soon as he logs in

I'm wishing to create a log myself where I wish to: 1.Write a script in /bin folder to make a separate log in var/log folder & 2.Call the script in bashrc each time a user logs in, I'm trying to avoid CRONJOB as it would take too much of my memory after iterations. So I just need to append the... (2 Replies)
Discussion started by: Lionking93
2 Replies

3. Shell Programming and Scripting

History of all the users in single file with command , date . time , ip and user

HTML Code: archive_history() { HISTORYOLD=${HISTFILE}.archive CURTIME=`date` CURTTY=`tty` IP=$(echo $SSH_CLIENT | awk '{print $1}') if ; then echo "#-${HOSTNAME}-- ${CURBASHDATE} - ${CURTIME} ($CURTTY) ${USER} ${IP}----" >> $HISTORYOLD history... (0 Replies)
Discussion started by: rehantayyab82
0 Replies

4. Shell Programming and Scripting

History of all the users in single file with command , date . time , ip and user

HTML Code archive_history() { HISTORYOLD=${HISTFILE}.archive CURTIME=`date` CURTTY=`tty` IP=$(echo $SSH_CLIENT | awk '{print $1}') if ; then echo "#-${HOSTNAME}-- ${CURBASHDATE} - ${CURTIME} ($CURTTY) ${USER} ${IP}----" >> $HISTORYOLD history... (2 Replies)
Discussion started by: rehantayyab82
2 Replies

5. UNIX for Dummies Questions & Answers

History to Another file [local user history , but root access]

Hi all, My need is : 1. To know who , when , which command used. 2. Local user should not delete this information. I mean , with an example , i can say i have a user user1 i need to give all the following permissions to user1, : a. A specific directory other than his home... (1 Reply)
Discussion started by: sriky86
1 Replies

6. UNIX for Dummies Questions & Answers

Capturing the login logout details of user

Hi I'm new to Shell scripting .Can anyone please help me how to capture user's login and logout details and load them into a table... we are using Oracle DB on UNIX:confused: (3 Replies)
Discussion started by: rajmohan146
3 Replies

7. Shell Programming and Scripting

command history of a particular user in a multiuser environment

Is it possible to find out the history of recently typed in commands of a particular user in a multi user system? the history command expects a numeric argument with it. is it possible to find out the history o commands of a particular user say John_smith for example? (2 Replies)
Discussion started by: arindamlive
2 Replies

8. UNIX for Dummies Questions & Answers

The history command: See other users command history

Can anyone tell this: If two users are logged into the same server from different locations. Is there a way to see the history command of the other user? I tried the history command, but it is showing me only the commands I used. Thanks in advance for your help. Iamnew2solaris (1 Reply)
Discussion started by: iamnew2solaris
1 Replies

9. UNIX for Advanced & Expert Users

History to Another file [local user history , but root access]

Hi all, My need is : 1. To know who , when , which command used. 2. Local user should not delete this information. I mean , with an example , i can say i have a user user1 i need to give all the following permissions to user1, : a. A specific directory other than his home... (3 Replies)
Discussion started by: linuxadmin
3 Replies

10. Solaris

user logon details

how can i identifying whose are logged in last few days,time and date also want. what i will do for get that information (2 Replies)
Discussion started by: sijocg
2 Replies

Featured Tech Videos