tracking commands\changes

[telemorgan]

Hey guys

I am going on vacation next week and another administrator is going to take my place administering our two Solaris servers. I am not very confident in this guys abilities to take control of the system while I am away. I don't want to come back to a pile of headaches.

Is there any way that I could track the commands and\or changes that the administrator will be using while he is logged in for that week?

 

[Deleted]

What shell wwill the user be working with? (sh, csh, tcsh, bash)?

http://unixjunky.com

 

[spamly]

I'd recommend asking the administrator to use sudo instead of logging on as root. The syslog facility will then log the sudo commands and he or she will still be able to do all the duties that are needed.

Couple of gotchas:
-You'll have to make sure that the other admin doesn't use sudo to su to root. This would defeat the purpose of sudo.
-You'll also have to have a "break the glass" policy to allow root login at the console during emergencies.

Using sudo will also encourage the administrator to only use root privledges when it is really necessary.

 

[telemorgan]

There are only two accounts that we have on our system, root and oracle. He will have access to both while I'm away. The root account is using 'sh' and the oracle is using 'ksh'.

 

[telemorgan]

Spamly,

Im assumming "sudo" is just a user account that I create and just add to the sysadmin group or something?

Also about the gotcha's,

- I can disable the 'su to root' feature I believe

- The root pw is locked away in a security book, so a "break the glass" policy is already in place if I was not available.

Thanks, any other suggestions out there?

 

[Deleted]

I would create another account (let's call it "danger") and force that user to use sudo like 'spamly' recommends.

http://unixjunky.com

 

[spamly]

sudo is a custom command available at

http://www.sunfreeware.com

It allows limiting root access for specific commands.

For example:
sudo passwd jdoe
sudo usermod jdoe
sudo vi /etc/hosts