How to Audit Logins and access to some important files ?

[semsem1234]

Hi everybody,

I asking about How to Audit Logins to the system , and the access to some important files ?

Thanks in Advance.

Samir.

 

[semsem1234]

I am Using AIX 5.1 .

 

[columb]

The simplest way to audit logins is to add to /etc/profile

echo $LOGNAME logged in at `date "+%Y/%m/%d %H:%M"` >> /var/log/login.log

It's not very secure (anyone can delete the log)
Alternatively
echo $LOGNAME logged in at `date "+%Y/%m/%d %H:%M"` | mail mailbox@mailserver

 

[d3vzero]

You could also use the "last" command.

This command will parse the contents of the /var/adm/wtmp file, to provide you with a login history for the system.

File auditing can be enabled by configuring the audit facility. (Use "man audit" for info on this process).

For further info on configuring auditing you could look at
"Setting up Auditing" at

http://publib16.boulder.ibm.com/doc_link/en_US/a_doc_lib/aixbman/security/setting_up_auditing.htm

____________________
Sometimes it pays to stay in bed on Monday, rather than spending the rest of the week debuging Mondays code.

 

[semsem1234]

Thanks Columb & d3vzero,
I ll test them.

samir