Question about monitoring

[dschneider]

Hi all,
I have a problem with an application, which runs on unix-server. The front-end is used by a windows client, who connects with rexec. Now there is something wrong with login: A user who is known in the password list, and who is able to login in unix, cannot login with the client via rexec. I thin in the login procedure of the clientsoftware it looks in a file with further login information specific from the server application.
How can I monitor, which files will be asked or searched while logging in with the clientsoftware?

Thanks for all help!!

Best regards
Daniel

 

[pcunix]

rexec? What version of SCO has rexec? SCO has rsh (same thing, different name).

You *might* catch it with lsof (available from

http://www.caldera.com/skunkware

) but since the access is probably transitory, you probably need something more.


If you don't have trace (comes with develpment tools -

http://pcunix.com/SCOFAQ/scotec1.html#compiler

), you'll need to use System Auditing - assuming this is SCO 3.2v4 or v5

I would do this with a system doing as little else as possible. Auditing uses a LOT of disk space very quickly. Turn it on with /usr/lib/sysadm/auditsh, have your user rexec, and shut it off and run your reports (there's a reboot necessary in here too)


However- are you sure this is the app? Using rexec or rsh or rlogin requires more than just being able to login - is there a .rhosts file with the proper name in it or a hosts.equiv ?
Tony Lawrence
SCO Unix/Linux Resources

http://pcunix.com

tony@pcunix.com