Login or Register to Ask a Question and Join Our Community


Solaris

Audit useradd/userdel - Solaris 11

Login to Discuss or Reply to this Discussion in Our Community

 
Thread Tools Search this Thread
Operating Systems Solaris Audit useradd/userdel - Solaris 11
# 1  
Old 06-06-2018
Following will audit all commands issued by users as well as their login times, accompanied by arguments to those commands.

Then you can filter / rule out required stuff with your log system or scripts.

You want named user, not root, tomcat or other service running users.
This will follow SUID and user will audited as he su into anything else.

Default location being /var/audit and binary format accessible to root user.
That can be changed to syslog as well or both.

Code:
# This is an example.
usermod -K audit_flags=lo,ps:no username
auditconfig -setpolicy +argv
# restart audit subsystem

Using auditreduce and praudit command examine to logs.
This will apply for sessions after the audit subsystem has been restarted.

A compressed separate zfs file system is advised due to huge compression ratios on those files.

Audit system in solaris systems is quite good, no need for workarounds.
Play a bit with it to achieve desired level of audit.

Regards
Peasant
Login or Register to Ask a Question

Previous Thread | Next Thread

10 More Discussions You Might Find Interesting

1. Solaris

Audit not working on Solaris 10

hi, I enabled bsm modules (/etc/security/bsmconv) and rebooted Solaris 10. But service is going into maintenance state. I rebooted server and I see one error saying "sys/c2audit:audit_kssl() not defined properly". I am not sure, what it is indicating and how it should be fixed. Please suggest, how... (5 Replies)
Discussion started by: solaris_1977
5 Replies

2. Solaris

Enabling Solaris Audit log: Solaris 9

Dear All, I have one of my Servers, running Solaris 9. I wanna enable the Audit log enabling, the way I did in Solaris 10 Servers. After running, the bsmconv script, giving the reboots, modifying all the audit files in /etc/security, the audit is enabled, but the audit file which shall be... (3 Replies)
Discussion started by: sumeet1806
3 Replies

3. UNIX for Advanced & Expert Users

Solaris 10 useradd confusion[solved]

I installed Solaris 10 (8/11) and added an account for myself. It lives in /export/home/{name} but /etc/passwd shows it is /home/{name} where it seems to be mounted like a filesystem. I tried to create another account from the command line but it doesn't work the same way. I can't find... (7 Replies)
Discussion started by: dokhebi
7 Replies

4. Solaris

audit useradd userdel usermod in solaris 10

the previous thread on this problem was closed with no resolution/workaround that i could see...have there been any breakthroughs? :wall: (0 Replies)
Discussion started by: lisah66
0 Replies

5. UNIX for Advanced & Expert Users

Problem with useradd, -p option in Solaris 10

Good day all. I'm trying to add a user with useradd and the -p option to assign a project name, but the result is that the user is created with an error message: "UX: useradd: user.root name should be all lower case or numeric." The command: useradd -d /export/home/tester -g rtpgrp -G... (2 Replies)
Discussion started by: BRH
2 Replies

6. Solaris

useradd giving error in solaris 10

Hi, I have installed Solaris 10 in my PC and now installing Oracle10, but while adding a user i am getting following error: useradd -g oinstall -G dba -d /export/home/oracle oracle UX: useradd: ERROR: Inconsistent password files. See pwconv(1M). I have tried pwconv command,... (4 Replies)
Discussion started by: amitanshu.verma
4 Replies

7. Solaris

Audit in Solaris Servers.

Hi Friends I am a Solaries newbie and I am looking out for a software or command or config that can capture all commands run by all users on a server on a daily basis. I believe that this Audit is being done in almost all enterprises and would like to know how the same is done there. Any... (3 Replies)
Discussion started by: Hari_Ganesh
3 Replies

8. Solaris

audit useradd, userdel on solaris 10

I just want to audit and log to syslog when a user is added, removed or modified from the system. According to the docs I have: #/etc/security/audit_control dir:/var/audit flags:ua minfree:20 naflags:ua plugin:name=audit_syslog.so.1; p_flags=ua But neither syslog nor auditreduce -c ua... (7 Replies)
Discussion started by: glisha
7 Replies

9. Solaris

audit in solaris 10

can you please share what you use to audit what files are deleted, when files are deleted and who deleted them? thx (1 Reply)
Discussion started by: melanie_pfefer
1 Replies

10. Solaris

audit in solaris

How do I know that audit is enabled in soalris. in AIX 'audit query' command gives me the info whether auditing is on or not. Raghav (1 Reply)
Discussion started by: raghavender_sri
1 Replies
Login or Register to Ask a Question

LEARN ABOUT FREEBSD

userdel

userdel(1M)                                               System Administration Commands                                               userdel(1M)

NAME

       userdel - delete a user's login from the system

SYNOPSIS

       userdel [-r] login

DESCRIPTION

       The  userdel  utility  deletes a user account from the system and makes the appropriate account-related changes to the system file and file
       system.

OPTIONS

       The following options are supported:

       -r       Remove the user's home directory from the system. This directory must exist. The files and directories under  the  home  directory
                will no longer be accessible following successful execution of the command.

OPERANDS

       The following operands are supported:

       login    An existing login name to be deleted.

EXIT STATUS

       The following exit values are returned:

       0        Successful completion.

       2        Invalid command syntax. A usage message for the userdel command is displayed.

       6        The account to be removed does not exist.

       8        The account to be removed is in use.

       10       Cannot update the /etc/group or /etc/user_attr file but the login is removed from the /etc/passwd file.

       12       Cannot remove or otherwise modify the home directory.

FILES

       /etc/passwd             system password file

       /etc/shadow             system file contain users' encrypted passwords and related information

       /etc/group              system file containing group definitions

       /etc/user_attr          system file containing additional user attributes

ATTRIBUTES

       See attributes(5) for descriptions of the following attributes:

       +-----------------------------+-----------------------------+
       |      ATTRIBUTE TYPE         |      ATTRIBUTE VALUE        |
       +-----------------------------+-----------------------------+
       |Availability                 |SUNWcsu                      |
       +-----------------------------+-----------------------------+

SEE ALSO

       auths(1),  passwd(1),  profiles(1),  roles(1),  users(1B),  groupadd(1M), groupdel(1M), groupmod(1M), logins(1M), roleadd(1M), rolemod(1M),
       useradd(1M), userdel(1M), usermod(1M), passwd(4), prof_attr(4), user_attr(4), attributes(5)

NOTES

       The userdel utility only deletes an account definition that is in the local /etc/group, /etc/passwd, /etc/shadow, and /etc/user_attr  file.
       file. If a network name service such as NIS or NIS+ is being used to supplement the local /etc/passwd file with additional entries, userdel
       cannot change information supplied by the network name service.

SunOS 5.10                                                          8 Sep 1999                                                         userdel(1M)