Visit Our UNIX and Linux User Community


Monitoring SU usage


 
Thread Tools Search this Thread
Top Forums UNIX for Advanced & Expert Users Monitoring SU usage
# 1  
Old 09-28-2007
Monitoring SU usage

I hope this is the correct forum - apologies to all if I am mistaken.

We are fairly sure someone has got access to the root password on one of our machines and is 'playing silly b*****rs' with it.

Due to local politics we can't easily get the password changed and we need to gather some info to get things changed.

Does anyone know if it is possible to track/trace/log the use of su (or any other command for that matter though su is the one we are most interested in)

We are using Linux - uname -a output below

Linux <hostname> 2.4.9-e.57enterprise #1 SMP Thu Dec 2 20:45:51 EST 2004 i686 unknown

Many thanks for any info/advice
# 2  
Old 09-28-2007
Think there is an su log you can look at (assuming you have su logging switched on).

/var/log/sulog or /var/adm/sulog....

man sulog?
# 3  
Old 10-01-2007
sulog is available for SunOS only, it's not present on Linux. Instead, you can look at "/var/log/secure" file, the format is :
Quote:
Oct 1 15:29:44 sysgate su: pam_unix(su-l:session): session opened for user root by sysgate(uid=500)
Oct 1 16:06:02 sysgate su: pam_unix(su-l:session): session closed for user root
# 4  
Old 10-01-2007
ajcannon,
If someone got root once on your linux system then you're in trouble! Chance are he/she will be able to wipe out any suspicous activity such as root su/login etc...

But If the user is pretty dumb Smilie You can always alias the su command to log some info, something like
Code:
alias su='TOTO=`tty | sed -e 's,^/dev/,,'`; who -u |grep $TOTO>> /tmp/su.log; /bin/su'

# 5  
Old 10-01-2007
Quote:
Originally Posted by ajcannon
We are fairly sure someone has got access to the root password on one of our machines and is 'playing silly b*****rs' with it.

Due to local politics we can't easily get the password changed and we need to gather some info to get things changed.
Then you either don't comprehend the seriousness or don't care about security.

If you had a bull rampaging in your china shop would you be trying to find the farmer or trying to protect your merchendise?
# 6  
Old 10-01-2007
Stuff the politics, there are bigger concerns than people's ego's.

It's a security issue.
Just change the root password.

Not sure if it's the case with all unix/linux systems, but on HP-UX you can restrict who can su to root (I called the group 'rooters') . If you're not in that group, then no can do.

Cheers,
Cameron

Last edited by Cameron; 10-01-2007 at 10:33 PM.. Reason: poor punctuation ;)
# 7  
Old 10-01-2007
Quote:
Originally Posted by Cameron
Not sure if it's the case with all unix/linux systems
With NetBSD and some other systems you have to be a member of the "wheel" group.

Previous Thread | Next Thread
Test Your Knowledge in Computers #705
Difficulty: Medium
Confirmation bias is the tendency to search for, interpret, favor, and recall information in a way that affirms what we currently believe or think we already know.
True or False?

10 More Discussions You Might Find Interesting

1. UNIX for Beginners Questions & Answers

Disk usage monitoring and record the disk used in last 24 hour

HI I am Trying to edit the below code to send email every day with difference of disk utilized in for last 24 hours but instead getting same usage everyday. can you please help me to point out where my calculation is going wrong. Thank you. ================= #!/bin/bash TODAY="at $(date... (0 Replies)
Discussion started by: Mi4304
0 Replies

2. Infrastructure Monitoring

Recording / Monitoring Shell Script Resource Usage.

I need to record min and max resources for RAM, & CPU for each command's execution in a shell script. Maybe going in details I would also be interested to capture plots with resource usage i.e.start to end of individual command with respect to time in a shell script. Please share ideas. (0 Replies)
Discussion started by: vaibhavvsk
0 Replies

3. UNIX for Dummies Questions & Answers

Memory usage per user,percent usage,sytem time in ksh

Let's say i have 20 users logged on Server. How can I know how much memory percent used each of them is using with system time in each user? (2 Replies)
Discussion started by: roy1912
2 Replies

4. Infrastructure Monitoring

Monitoring CPU Usage with SNMP

Can someone please tell me how to calculate the CPU usage from what one gets back from snmpwalk? I have searched and dug through the internet and apparently, no one has the answer to this? i can use snmpwalk to pull out relevant information about cpu. but i have no clue what values are to be... (1 Reply)
Discussion started by: SkySmart
1 Replies

5. UNIX for Advanced & Expert Users

Monitoring cpu usage of mysql processes/threads/queries without any tool

hi all, i want to monitor mysql processes/threads/queries with respect to cpu usage.how can i do it? show processlist is of no use as no information abt cpu usage is given. plz help (7 Replies)
Discussion started by: rohitmahambre
7 Replies

6. AIX

How to monitor the IBM AIX server for I/O usage,memory usage,CPU usage,network..?

How to monitor the IBM AIX server for I/O usage, memory usage, CPU usage, network usage, storage usage? (3 Replies)
Discussion started by: laknar
3 Replies

7. Solaris

current CPU usage, memory usage, disk I/O oid(snmp)

Hi, I want to monitor the current cpu usage, monitor usage , disk I/o and network utlization for solaris using SNMP. I want the oids for above tasks. can you please tell me that Thank you (2 Replies)
Discussion started by: S_venkatesh
2 Replies

8. HP-UX

how can I find cpu usage memory usage swap usage and logical volume usage

how can I find cpu usage memory usage swap usage and I want to know CPU usage above X% and contiue Y times and memory usage above X % and contiue Y times my final destination is monitor process logical volume usage above X % and number of Logical voluage above can I not to... (3 Replies)
Discussion started by: alert0919
3 Replies

9. HP-UX

Memory Usage Monitoring

Hey guys how do you determined how much memory is consumed a certain process in HP-UX,Also is there any other way of determining free memory if memdetail and sar -r is unavailable? (2 Replies)
Discussion started by: sbn
2 Replies

10. UNIX for Advanced & Expert Users

Monitoring CPU usage on AIX 5.3 with SNMP

Hi I would like to monitor CPU usage ( %) , memory utilization and such on an AIX 5.3 with snmp. How would I do that ? :confused: If I do "snmpwalk -c public -v1 hosttomonitor" I get nothing about the CPU. I've done this on Linux ( not much trouble doing it on linux ) but I'm having a hard... (2 Replies)
Discussion started by: art
2 Replies

Featured Tech Videos