Use of audit

[owen68]

Hello,
I'm new to Unix I'm running an MIS on Unix and want some advice on how to monitor failed logins, and who's accessing it and when.

I found the command who -a /etc/security/failedlogin but got loads of information.
How do I get the output into a file, and how can I restrict the command to look within range of dates or a single date.

I also want to understand audit. I looked at the man page but it makes no sense to me.

I think that's enough for now!

 

[mkharris]

First of all, getting output into a file is straightforward; in your example:
who -a /etc/security/failedlogin > filea
will put everything into filea. If you use a pattern matching filter, like grep, then you can pipe the output into this and narrow down your search. For example:
who -a /etc/security/failedlogin | grep " Aug " > filea
will list out only entries for last August.

You can always do things a bit more interactively with the vi editor. Everyone who is new to unix instantly falls in love with this

You might want to have a little play with vi, pipes and filters before you progress into audit.

That's what I've been doing for the last 5 years.

Mark

 

[aixqueen]

who /etc/security/failedlogin > /tmp/failedloginfile

flag not needed... It is in order by date?
and Unknown users can be modem noise or someone trying to get in.

If you are just trying to find out who is trying to get into your system, I don't think you want accounting or auditing. Auditing is a pig disk wise..... If you are trying to track a particular users or writes and reads, deletion of files, changing of files, etc...maybe

Audit

http://techsupport.services.ibm.com...mode=9&documents=490605195614808&database=aix

http://publib.boulder.ibm.com/doc_link/en_US/a_doc_lib/aixbman/admnconc/audit.htm

http://publib.boulder.ibm.com/doc_link/en_US/a_doc_lib/aixbman/baseadmn/audit_setup.htm

Accounting:

http://techsupport.services.ibm.com...mode=9&documents=390605193914784&database=aix

http://techsupport.services.ibm.com...mode=9&documents=090605195214800&database=aix

 

[owen68]

Thanks for replying so quickly. It looks like I've got a lot of reading to do!

 

[aixqueen]

Not to add to your burden of reading...but there are two great redbooks
that go into auditing and security for systems...
you can download them free from

http://www.redbooks.ibm.com

http://publib-b.boulder.ibm.com/Red...a2502989b5dc09f18525689b00740f90?OpenDocument

http://publib-b.boulder.ibm.com/Red...88de6ce1624fd8e48525659d002a5669?OpenDocument

http://publib-b.boulder.ibm.com/Red...8934e5c6a09d1094862569bb0074cfaa?OpenDocument

 

[owen68]

Thanks again, I'll be keeping busy