Sniffering System Commands of ROOT User

[olli2003]

Hi!

I've a strange problem...
on of my collegues claimed, that I've set up critcal Sytem Commands as User "ROOT" in the system. (SUN Solaris 10)
Now I'm interested in, where he could see such logs!
May be ROOT was controlled by an audit process...?
Is it possible to to so?
How can I see if such an audit daemon is activated?
Where can I find it's logfile and how can I read it?
So may be it's possible to fetch such informations by the history file?
The informations must be exactly have the content of:
1. At which time ROOT was logged on and from which machine.
2. Which commands were set up by this user?

Thanks a lot for all your help!

Kind Regards
Oliver

 

[Annihilannic]

Did he mention anything specific? Otherwise it's hard to guess...

Annihilannic.

 

[KenCunningham]

/var/adm/sulog might contain information if the user su-d to root. As you say, the .sh_history file might contain information if it hasn't rotated or been purged for whatever reason.

What are these 'critical system commands'? As Annihilannic says, we really need more information.

 

[marrow]

Oliver, example system commands such as "halt" & "reboot" can be found under /etc and they are indeed root owned and powerful(also linked to /usr/sbin), unless permissions are really nailed down anybody can run a "ls -al" against the /etc & /usr/sbin directories and get this information. Has your colleague attained a little knowledge but not enough to know the system?

Good luck anyway

 

[olli2003]

Hi!

Thanks a lot for all your replies and
sorry for my late answer.
I can't explain in a good way, but may be this person
had some external tools to do this...
Howether... it were such commands like "format", "netstat" f. ex.

How can I use the "bsmconv" command,
and what exactly it's doing?


Have a nice weekend and

Kind Regards
Oliver

 

[marrow]

Hello Oliver, netstat & format are both owned by root, whilst format can only be run as the root user. So this is normal for all Solaris o/s, I don't see that you have any security problems.

I've never used "bsmconv", but you can "man bsmconv" for more infomation.

See you

Marrow

 

[mrn]

Is there nothing in history?

Mike

"A foolproof method for sculpting an elephant: first, get a huge block of marble, then you chip away everything that doesn't look like an elephant."

http://www.airport-parking-site.co.uk/