Trace connections

Thread Tools Search this Thread
Top Forums UNIX for Advanced & Expert Users Trace connections
# 1  
Old 02-12-2002
Question Trace connections

In my organization in order for anyone to go to any Unix server they have to go through "SERVER A" and login as themselves.

Then people are free to go enywhere they please.

For example:

SERVER A, loggs in as himself
telnets to SERVER B, loggs in as guest
telnets to SERVER C, loggs in as root
telnets to SERVER A, loggs in as root
telnets to SERVER D, loggs in as user
telnets to SERVER Y, loggs in as root

when i run 'who' on "SERVER Y" i see 20 roots logged in.

I want to be able to trace 1 particular root back to SERVER A, where he logged on as himself

Thanks for all help and suggestions.

# 2  
Old 02-12-2002
Root logins are generally considered to be a major no-no, for the very reason you state in your post. It is time consuming and sometimes difficult to determine who logged in as "root" at a given time, especially when 20 or more people have root access to your boxes. You may be able to sort it out but its not going to be fun.

The simple way to solve your main problem is to disallow root logins and force users to use su or sudo. Assuming they all need root access (doubtful but possible). When root access is needed for more than one command su leaves a message in the system log stating the user who su'd and the terminal they did it from.
# 3  
Old 02-12-2002
yes, but

Forget about roots, what if i have 20 'user' account on the box.
For example:

gfadm pts/0 Feb 12 08:38 (apdv1-26)
gfadm pts/7 Feb 12 15:32 (apdv1-26)
root pts/1 Feb 12 14:10 (apdv1-26)
gfadm pts/4 Feb 12 11:15 (gfbtap1)
gfadm pts/5 Feb 12 14:44 (gfbtap4)
root pts/16 Jan 25 12:38 (apdv1-26)
gfadm pts/12 Feb 8 08:44 (apdv1-26)

and i am interested in the last 'gfadm' on pts/12

how can i find our where did he come from and what was he logged on as?

# 4  
Old 02-12-2002
There may be an easier way to do this...but this is how I'd do it.
Use last to find the host the user in question is logged in from. Then go to that box and use 'ps' to determine who is telnetting to the box in question. If there is more than one person, The BOFH way would be to kill each process until the user in question mysteriously disappears from the target machine, but you probably dont want to do that. You can probably use a bit of common sense and login times etc to guess. Repeat this process until you reach machine A and the real username.

If the user has logged out it makes it more difficult.
# 5  
Old 02-12-2002
Thank you very much for your reply.

I was thinking about doing exactly what you suggested, but was just wondering if there is an easier way to go about it.

There has to be.

If not - let's write it.

Seriously there are a lot of very smart people on this board, lets make it happen

What do you think?

# 6  
Old 02-22-2002
Lightbulb Telneting in as ROOT is NO NO

From your posting you want to track users who are logging in as Root and what they are doing.

Easiest way is to block root from telneting in from remote connections. Force the users to login as themselves and then "su" over to root. You can then log all su attempts (successful and un-successful) and track the people backwards across the servers.

Basic Security rule is to only allow Root to login from the Console Terminal physically located at the server.
# 7  
Old 02-22-2002
Are your people logging into the initial unix server from a PC?
What we do, is assign each PC a unique id. We can trace the login id via the PC id which shows up in the finger command.

Also, our system has /usr/var/adm/syslog.dated files.. which trace all root logins and what device they are coming from. You could then trace the device.

Hope this helps
Login or Register to Ask a Question

Previous Thread | Next Thread

10 More Discussions You Might Find Interesting

1. AIX

Trace su to root

Hi, is it possible to trace everything about user that changes from its own user to root user, failed and successful attempts (I would need user and IP address of user that was trying to do that)? I tried adding auth.notice and in syslog.conf but it only tracks user withoud IP... (6 Replies)
Discussion started by: sprehodec
6 Replies

2. Shell Programming and Scripting

Stack Trace

Hi All Thought it would be kind of fun to implement a stack trace for a shell script that calls functions within a sub shell. This is for bash under Linux and probably not portable - #! /bin/bash error_exit() { echo "=======================" echo $1 echo... (4 Replies)
Discussion started by: steadyonabix
4 Replies

3. UNIX for Dummies Questions & Answers

Help with trace file

Hi, I am an oracle DBA pretty new to unix. We had one of the filesystems full and a colleague cleared some stuffs to create more space. I just checked now and found there is now more space available. How do i find exactly what he cleared? We have oracle database installed and its a RAC... (4 Replies)
Discussion started by: dollypee
4 Replies

4. Solaris

Log Trace

Hi I would like to display only error messages from my log files while monotring application on my solaris box using tail command. Is there other way we can monitor please let me know? In general # tail -f "xyz.log' ---> this will display current activity of the logs, instead i would like... (4 Replies)
Discussion started by: gkrishnag
4 Replies

5. Shell Programming and Scripting

how to supress the trace

Hi I am working in ksh and getting the trace after trying to remove the file which in some cases does not exist: $ my_script loadfirm.dta.master: No such file or directory The code inside the script which produces this trace is the following: ] || rm ${FILE}.master >> /dev/null for... (3 Replies)
Discussion started by: aoussenko
3 Replies

6. HP-UX

How to trace a user

on HP-Unix how can i trace user for example "xxx999" ? (4 Replies)
Discussion started by: salhoub
4 Replies

7. HP-UX

how to trace the logs

Hi, Last day, In one of our unix boxes there was an issue wherein few of the directory structures were missing / got deleted. Is there any way by which we can find how it happened, I mean by going through syslog / which user had run what command? Thanks for your help (3 Replies)
Discussion started by: vivek_damodaran
3 Replies

8. UNIX for Dummies Questions & Answers

Trace DHCP - Help!

Can someone help me with commands to trace DHCP on an HP_UX box? Thanks! (0 Replies)
Discussion started by: nuGuy
0 Replies

9. Shell Programming and Scripting

Function Trace

Does anyone know if there is a util out there to run through a shell script and be able to trace the function call tree. I have inherited some code and the original author was ****mad**** keen on functions - even ones called only once! If anyone knows of anything I would appreciate it - web... (3 Replies)
Discussion started by: ajcannon
3 Replies

10. IP Networking

trace route ip

hi everybody , i have a solaris 5.6 box and i want to trace the route on an ip i treid traceroute but soalris 5.6 does not support it ... is there a command that can be used equivelent to traceroute ? thanks for your help (2 Replies)
Discussion started by: ppass
2 Replies
Login or Register to Ask a Question