UNIX for Dummies Questions & Answers

Hello all.

In my organization, users access the Host using Putty.
And the root login is disabled, so users enter as low-privilege users.

Sometimes, they need to enter "root" account,
and we want to monitor what they do after this point.

I have been told that a keyboard trace can be activated
when this remote user uses "SU -" to continue as ROOT.

Can you tell me how is it done ?
Thanks a lot. Sebastian.

A keyboard trace?
You mean history of type commands?
For a start you could modify root's .kshrc or .profile or... to create a new HISTFILE at each connection using the timestamp and name of user who just "su - "ed.

Yes, this would be ok.
What command(s) must be placed in "root's" profile file ?

for the user it depends on OS (HPUX, I use LOGNAME variable...)

in .profile:

Code:

 export HISTFILE=/home/root/.sh_history.$SUFF

Where SUFF variable is up to us to set (using username, date as you wish...)

I will try it next week, thanks !
(this weeks I am away from home, ontraining course)

mr VBE : how can I know the user that is doing the "su" into root,
in order to generate the "suffix" ?
Sebastian.

IF nobody can login via putty as root, then the only way to get into root is "su".