Solaris

Hello,

I was wondering when Solaris auditing is enabled, If it is possible to keep track of users that are allowed to sudo to root. In other words, I would like to know which user did what on my Solaris box. (assumig that user can "sudo su -" )

Thanks.

if the user doesn't disable auditing... you can. a better option would bei "RBAC" for a finer granularity in user rights. so you can have a user with almost root capability, just without the right to mess with auditing.

http://docs.sun.com/app/docs/doc/816...8?l=all&a=view

Well, I am also using RBAC with LDAP auth. This is not the case.

We have 3rd party application that needs root (userid 0) acount to be managed. So we grant related users "sudo su -" permission. What I am trying to find is when two or more users are logged in and switched to root, how could I determine which user (with root account) did what ?

---------- Post updated 09-22-10 at 09:00 AM ---------- Previous update was 09-21-10 at 12:07 PM ----------

Hi again,

I figured out a solution as follows:

Each login via ssh is logged as an entry in /var/adm/lastlog, I could see it using "last" command. So I know which user is connected to which terminal, like "pts/2". So, if I can log shell history with the terminal information then I could easily find which command is executed by which user.

Am I missing anything that should be taken into account ?