UNIX for Dummies Questions & Answers

First timer here... appreciate any help. My lingo might be off a bit, but ill clarify where necessary.

1- Is there a way to monitor direct logins to root? i.e. logging in directly to root as opposed logging in to a user account then su or sudo to root. i have a machine set to "permitrootlogin yes" temporarily and want to monitor direct root logins. (i know this isnt an ideal setting for that option, but let's assume this is the case for now)

2- when logged in as root, does a user need to still type su to run commands? If so, are those commands captured in the sulog? (i dont have access to a UNIX machine at the moments so i cant test this out).

thanks for any help!

It's by no means perfect and success can vary across *ix platforms, but usually "logins" will create a wtmp entry (you can use the "last" command to browse). Remember, root can do anything, including covering up tracks it leaves behind (you have been warned).

1)
you should not allow direct root logins over the network. IMO forget about auditing if this is allowed.

2)
su is not used/needed when logged in directly as root. when a person has root they have the ability to cover their tracks if needed.

thanks for the feedback. i'm well aware their own tracks might be covered. But was looking at some built-in alternatives/monitoring that perhaps i wasnt aware off. that setting should always be set to 'no' or 'without-password' using public/private keys...