Re: command logging
On Tuesday, November 08, 2011 03:40:14 PM Frank Kruchio wrote:
We are running RHEL5 x86_64 and RHEL4 (32 and 64 bit) servers mostly
at
work and management like to trac every single command a user types.
So far we used rootsh but once a user types
sudo rootsh
sudo su - oracle
the oracle user commands are not logged any more.
Is there a way to trac/record a user to see what was typed using the audit
subsystem ?
On RHEL5, probably after 5.4 or 5.5 and upstream kernels after 2.6.24 or 25, you can
use pam_tty_audit. There is a man page that explains how to set it up and its pretty
obvious what it does. You need to use the ausearch program to see what's in the events
or the aureport --tty report. RHEL4 has no such facility.
We are considering the idea now to
> /etc/securetty
to lock root logins out
The goal is to not have any shared IDs at all and all users should be
identified on what they did on the servers if necessary.
For the audit system to work correctly, you should not allow root logins. The auid
field in the events will track who did anything.
-Steve