How to know which user is messing up with the system?
Hello,
In our environment some users mess up with the system ( install / uninstall ) software..
unfortunately the root is open to several users (several of them have sudo access)
How to track which user is trying to do this ( I'd like to know which user and what ipaddress. )
Experts please shed some light; how to approach to take control of the situation (systems) and avoid future incidents.
Hello,
In our environment some users mess up with the system ( install / uninstall ) software..
unfortunately the root is open to several users (several of them have sudo access)
How to track which user is trying to do this ( I'd like to know which user and what ipaddress. )
Experts please shed some light; how to approach to take control of the situation (systems) and avoid future incidents.
Thanks,
R
Check the authentication log (/var/log/auth.log). It will tell you who logged in to your server, when, and what he/she did.
Alternatively you can also check their respective history files to see what commands they ran.
If you can change the root password and removing the sudo privileges to switch user to root, even better. No access means no chance of errors by them again. Be careful with sudo rules though. Some commands sudh as vi, ftp and seemingly harmless more may allow you to escape to a shell prompt as a root privilege user. Work on the basis of allowing as little as possible for everything.
If you have to share access, do you have a line in your /etc/syslog.conf (or rsyslog.conf) for:-
Code:
*.debug /my/system/log
If so, then there may be some clues in there, whatever it is defined to. The problem may come in working out what action caused the problem, when it happened and then tracing back. Perhaps you could include some tracing in your /etc/profile to record more useful information.
I hope that this helps,
Robin
Liverpool/Blackburn
UK
I noticed my hostname is <my-full-name>s-macbook.local. I'm not sure exactly what information leaves the local network, and whether the hostname is included, but if it is, this would mean people on the Internet can look at my hostname and see who I am. Before anyone says that's not possible,... (4 Replies)
i am prompting for a name to search.
read user
if
then
however, i get this error:
please enter a username on the system:
fool
menu_script2.sh: line 123: (4 Replies)
Hello,
I'm implementing a very simple FTP client, and to do the login I would like to check against system users instead of using my own database, so that I can give the proper permissions to the newly created process that I spawn with fork. What's the best way for doing this in C?
I've read... (4 Replies)
Does anybody know how to keep SCCS from changing the wrong module keywords? I'm thinking of a don't translate after this line kind of operation.
I see where you can use get with a -k but then no keywords get translated. It's either all or none.
I use simply
# %A%
# %G% %T%
in all my... (1 Reply)
Not sure if that title is decent, but here we go. I'm running this string of commands:
qstat -f $1 | sed 's/^*//' | sed -n -e ":a" -e "$ s/\n//gp;N;b a" | sed 's/\\,/,/' | awk -F"PBS_O_WORKDIR=" '{print $2}' | awk -F",PBS_O_SYSTEM" '{print $1}'In case you're curious is takes the output of a PBS... (3 Replies)
Helo,
I have created one group called RBAC.(roll back access control)
Now when I created user of RBAC its entry in /etc/passwd file is given below:
roleadm:x:120:109:RBAC User:/home/pds_RBAC:/bin/false
I have keep at the end /bin/false because I dont want to give direct login to the user... (2 Replies)
Hi,
I'm new to solaris/ Unix and would like to know how to check in the system what
was the last login user were doing. Is there any way to check this? Thanks in advanced. (1 Reply)
The directions below were provided by someone on the unslung mailing list. unslung is a linux OS for LinkSys's $100 NSLU2 NAS controller.
I'm posting the query here because
(1) I think it is really a generic linux/unix questions
(2) I did not get a response in the unslung mailing list.
I... (1 Reply)
