command to see the user changing logon

[h3nd]

Hi guys,

I just need the check the user id that do su command switch to admin application logon.

Do you guys have any idea what command is it?

Thx guys

 

[columb]

On AIX check /var/adm/sulog. Personally I have a script which checks for

1. Anyone other than the admin group using su root
2. Anyone have > 2 unsuccessful su attempts.

I'll post it if you're interested.

Ceci n'est pas une signature
Columb Healy

 

[h3nd]

I'm using redhat atm.

Yes, I'm interested to see ur script please.

Thanks man

 

[coffeysm]

I set my su command so only people in a certain group can run it.

chgrp wheel /usr/bin/su
chmod o-rx /usr/bin/su
add my user to the wheel group

 

[h3nd]

Thx coffeysm,

but In this case I am one of the support system.
and one group contain 3 people. So we have right to su to functional logon.

But I need to know which one does which, because we're not allowed to logon straight using functional logon. We need to logon as our own user and then su to functional logon.

So our admin can detect what we are doing.

Thx

 

[KenCunningham]

I don't fully understand about the group situation, but sulog should give you the details as to who is su-ing to your 'functional logon' as suggested above, as long as they are doing so from a uniquely identifiable userid. If they aren't, you have a security issue and might consider introducing individual userid to enable the audit trail that you're after.

I don't mind people who aren't what they seem. I just wish they'd make their mind up.

Alan Bennett.

 

[KarveR]

On Redhat ES there is no sulog, info is instead in /var/log/everything

grep -e "su(pam.*opened for user root" everything |awk '{ print $1,$2,$3,$12}'

______________________________________________________________________
There's no present like the time, they say. - Henry's Cat.

 

[h3nd]

Thx guys,

my OS is Redhat AS, there is sulog and there is no everything.

But i dont have right to open it

 

[coffeysm]

Oh well my scenario was for only allowing certain people (ie: sys admins) to actually run the su command. If you can su to root then why not look at the sulog under that account? Do you just need to know who runs the su command or what they are actually typing? I would look into sudo instead if that is what you are trying to find out.

 

[h3nd]

Well, I just need to know who is su to "microadm" which is my functional logon and I dont have root access.

I dont care by find out by their typing or any log.

Any idea how ?

 

[PHV]

In the microadm's profile you may test $LOGNAME against $(logname) ...

Hope This Helps, PH.
Want to get great answers to your Tek-Tips questions? Have a look at FAQ219-2884 or FAQ181-2886

 

[coffeysm]

Either make the sulog 644 so you can read it. 640 and add you to the group that the file belongs to. You could also look into aliases to log the username before the command is actually ran. You might also want to look into seeing if sudo is or can be setup on your system.

 

[mrn]

Red Hat logs the login and sulogin activity under /var/log/messages file.

You can change the following to use /var/log/sulog

add following line to /etc/syslog.conf file and then touched /var/log/sulog file.

----
auth.info /var/log/sulog
# ^^^^ this white space is TABs, not spaces
-----

and then,
/etc/init.d/syslog restart



Mike

"Whenever I dwell for any length of time on my own shortcomings, they gradually begin to seem mild, harmless, rather engaging little things, not at all like the staring defects in other people's characters."

 

[h3nd]

Thx mrn,

your suggestion is nice but I can't add the line to
"/etc/syslog.conf" file.

coz there is read permission only dont have write access.

Does it mean there is no way for me to check it even I have access to my microadm ?

 

[PHV]

Have you write access to the microadm's profile ?

 

[KenCunningham]

In most *nixes, as root, if you vi certain files and try to save them, vi will 'pretend' that it can't be written (presumably for security against dabblers I guess). However, it can actually be written using wq! to force the issue.

I don't mind people who aren't what they seem. I just wish they'd make their mind up.

Alan Bennett.

 

[h3nd]

no, the problem is the "/etc/syslog.conf" file is belong to root.

So the permission is rw-r--r--, so I can't edit that file

 

[KenCunningham]

Well ask someone who can, perhaps?

I don't mind people who aren't what they seem. I just wish they'd make their mind up.

Alan Bennett.