UNIX for Dummies Questions & Answers

Hi everyone,

I have a situation where I need my personal account (say bob1) to login into a Red Hat 6 server, su to a system/application account (say app1) and kick off a script to do x,y and z. This isn't an issue.

Now once I su- to the app1 account and kick-off the script this script then logs into various hosts using various system accounts. For example app1 logs into app2, app3 and app4 on 3 different hosts and starts executing remote commands.

So my question is does the Linux o/s have an inbuilt tracking/logging mechanism somewhere that would show all these activities against the original personal account bob1 who started the whole change (I believe yes but not sure where to look for this) OR once app1 jumps to app2 logging is lost even if I am logged in on a personal account?

Thanks in advance!

You could log script output and use the last command to see your last logins per system. You could also look in your shell history as well.

Thanks! Was looking for something inbuilt I could refer to like syslog on the first host. But maybe I would need some third party audit type tool.

Linux does not have such a feature out of the box. It is possible to build such a thing, though: search for "SnoopyLogger", which is open software and does log any command a user issues (which should create a log containing what you want to achieve). You can send these messages to a remote host (for instance by using syslog-ng) which would make the log auditable.

Notice that a locally kept log will not be auditable because the local root-account could tamper with the file. You will need a remote server where the admin has no root-authority.

I hope this helps.

bakunin