Visit Our UNIX and Linux User Community


How to know which user is messing up with the system?


 
Thread Tools Search this Thread
Top Forums UNIX for Advanced & Expert Users How to know which user is messing up with the system?
# 1  
Old 08-16-2013
How to know which user is messing up with the system?

Hello,
In our environment some users mess up with the system ( install / uninstall ) software..
unfortunately the root is open to several users (several of them have sudo access)
How to track which user is trying to do this ( I'd like to know which user and what ipaddress. )

Experts please shed some light; how to approach to take control of the situation (systems) and avoid future incidents.

Thanks,
R
# 2  
Old 08-16-2013
Quote:
Originally Posted by ramky79
Hello,
In our environment some users mess up with the system ( install / uninstall ) software..
unfortunately the root is open to several users (several of them have sudo access)
How to track which user is trying to do this ( I'd like to know which user and what ipaddress. )

Experts please shed some light; how to approach to take control of the situation (systems) and avoid future incidents.

Thanks,
R
Check the authentication log (/var/log/auth.log). It will tell you who logged in to your server, when, and what he/she did.
Alternatively you can also check their respective history files to see what commands they ran.
# 3  
Old 08-20-2013
If you can change the root password and removing the sudo privileges to switch user to root, even better. No access means no chance of errors by them again. Be careful with sudo rules though. Some commands sudh as vi, ftp and seemingly harmless more may allow you to escape to a shell prompt as a root privilege user. Work on the basis of allowing as little as possible for everything.


If you have to share access, do you have a line in your /etc/syslog.conf (or rsyslog.conf) for:-
Code:
*.debug       /my/system/log

If so, then there may be some clues in there, whatever it is defined to. The problem may come in working out what action caused the problem, when it happened and then tracing back. Perhaps you could include some tracing in your /etc/profile to record more useful information.



I hope that this helps,
Robin
Liverpool/Blackburn
UK

Previous Thread | Next Thread
Test Your Knowledge in Computers #204
Difficulty: Easy
The BGP routing protocol runs over User Datagram Protocol (UDP).
True or False?

10 More Discussions You Might Find Interesting

1. IP Networking

Can I change my hostname without messing things up?

I noticed my hostname is <my-full-name>s-macbook.local. I'm not sure exactly what information leaves the local network, and whether the hostname is included, but if it is, this would mean people on the Internet can look at my hostname and see who I am. Before anyone says that's not possible,... (4 Replies)
Discussion started by: Ultrix
4 Replies

2. Shell Programming and Scripting

find a user on the system

i am prompting for a name to search. read user if then however, i get this error: please enter a username on the system: fool menu_script2.sh: line 123: (4 Replies)
Discussion started by: icelated
4 Replies

3. Programming

Best way to check for system user and password in C

Hello, I'm implementing a very simple FTP client, and to do the login I would like to check against system users instead of using my own database, so that I can give the proper permissions to the newly created process that I spawn with fork. What's the best way for doing this in C? I've read... (4 Replies)
Discussion started by: royger
4 Replies

4. Shell Programming and Scripting

SCCS is messing up my date format strings

Does anybody know how to keep SCCS from changing the wrong module keywords? I'm thinking of a don't translate after this line kind of operation. I see where you can use get with a -k but then no keywords get translated. It's either all or none. I use simply # %A% # %G% %T% in all my... (1 Reply)
Discussion started by: Back-N-Black
1 Replies

5. Shell Programming and Scripting

variable redirect messing up a sed command.

Not sure if that title is decent, but here we go. I'm running this string of commands: qstat -f $1 | sed 's/^*//' | sed -n -e ":a" -e "$ s/\n//gp;N;b a" | sed 's/\\,/,/' | awk -F"PBS_O_WORKDIR=" '{print $2}' | awk -F",PBS_O_SYSTEM" '{print $1}'In case you're curious is takes the output of a PBS... (3 Replies)
Discussion started by: dhibbit
3 Replies

6. Solaris

diff b/w /etc/system and user profile..

Hi Everybody, Can somebody tell me the difference between /etc/system and user profile???? (2 Replies)
Discussion started by: tirupathiraju_t
2 Replies

7. UNIX for Advanced & Expert Users

user is not able to FTP to system.

Helo, I have created one group called RBAC.(roll back access control) Now when I created user of RBAC its entry in /etc/passwd file is given below: roleadm:x:120:109:RBAC User:/home/pds_RBAC:/bin/false I have keep at the end /bin/false because I dont want to give direct login to the user... (2 Replies)
Discussion started by: amitpansuria
2 Replies

8. Solaris

How to check the last login user were doing in the system

Hi, I'm new to solaris/ Unix and would like to know how to check in the system what was the last login user were doing. Is there any way to check this? Thanks in advanced. (1 Reply)
Discussion started by: raziayub
1 Replies

9. UNIX for Advanced & Expert Users

How to add user on Embedded System

The directions below were provided by someone on the unslung mailing list. unslung is a linux OS for LinkSys's $100 NSLU2 NAS controller. I'm posting the query here because (1) I think it is really a generic linux/unix questions (2) I did not get a response in the unslung mailing list. I... (1 Reply)
Discussion started by: siegfried
1 Replies

10. UNIX for Dummies Questions & Answers

kicking a telneted user from the system

hi there, does anyone know how to kick a telneted user from a the system? thx (3 Replies)
Discussion started by: crashnburn
3 Replies

Featured Tech Videos