[HPADM] RE: Security Tracking

• Previous message: Binkley Robert - rbinkl: "[HPADM] Security Tracking"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

To: Binkley Robert - rbinkl <Robert.Binkley@acxiom.com>, "Hpux-Admin (E-mail)" <hpux-admin@dutchworks.nl>
Date: Thu, 17 Jul 2003 11:36:46 -0500

Thanks to everyone that replied::
 
 

-----Original Message-----
From: Binkley Robert - rbinkl [mailto:Robert.Binkley@acxiom.com]
Sent: Thursday, July 17, 2003 11:00 AM
To: Hpux-Admin (E-mail)
Subject: [HPADM] Security Tracking

Hello Admins
  I have been given a task , on monitoring one of out credit customers
boxes.
  The problem I am faced with is that, The customer wanted to know if there
is a way to track each users .sh_history for rmdir or rm* or rm -rf and log
the information in a file.
 
 

---------------------------------------------------------------------

**********************************************************************
The information contained in this communication is
confidential, is intended only for the use of the recipient
named above, and may be legally privileged.
If the reader of this message is not the intended
recipient, you are hereby notified that any dissemination,
distribution, or copying of this communication is strictly
prohibited.
If you have received this communication in error,
please re-send this communication to the sender and
delete the original message or any copy of it from your
computer system. Thank You.

attached mail follows:

To: Binkley Robert - rbinkl <Robert.Binkley@acxiom.com>
Date: Thu, 17 Jul 2003 11:23:03 -0500

Robert:
 
One way would be to create a script that executes as root. It can look at
each .sh_history file for every user listed in /etc/passwd and grep for
'rm'.
 
Here's a quick example:
 
    #!/usr/bin/ksh
    #
    # sh_hist_check
    #
    # Look at each user in /etc/passwd.
 
    while read LINE;do
            USER=$(awk -F: '{print $1}')
            HOMEDIR=$(awk -F: '{print $7}'
   
            # Does .sh_history exist in the user's home directory? If so,
grep for all occurrences of rm and
            # store information in file
 
            
            if [ -f $HOMEDIR/.sh_history ];then
                    echo "\nUser: $USER" >> /tmp/outfile
                    grep -w 'rm' $HOMEDIR/.sh_history >> /tmp/outfile

            fi
 
   done < /etc/passwd
 
   exit
 
 
Of course this can be modified as needed.
 
I hope this helps,

Steve Illgen
UNIX Systems Administrator
Cracker Barrel Old Country Store, Inc.
"Pass the Biscuits, Please!"

-----Original Message-----
From: Binkley Robert - rbinkl [mailto:Robert.Binkley@acxiom.com]
Sent: Thursday, July 17, 2003 11:00 AM
To: Hpux-Admin (E-mail)
Subject: [HPADM] Security Tracking

Hello Admins
  I have been given a task , on monitoring one of out credit customers
boxes.
  The problem I am faced with is that, The customer wanted to know if there
is a way to track each users .sh_history for rmdir or rm* or rm -rf and log
the information in a file.
 
 

---------------------------------------------------------------------

**********************************************************************
The information contained in this communication is
confidential, is intended only for the use of the recipient
named above, and may be legally privileged.
If the reader of this message is not the intended
recipient, you are hereby notified that any dissemination,
distribution, or copying of this communication is strictly
prohibited.
If you have received this communication in error,
please re-send this communication to the sender and
delete the original message or any copy of it from your
computer system. Thank You.

attached mail follows:

To: Binkley Robert - rbinkl <Robert.Binkley@acxiom.com>
Date: Thu, 17 Jul 2003 11:21:38 -0500

Robert:
 
Yes there is.
 
Set up all users .profile, or you may be able to do this in /etc/profie, to
:
 
    export HISTFILE=/tmp/.sh_history.$LOGNAME.$$
 
Then you have a file in /tmp/ (or somewhere else if you want it somewhere
else) that you can check.
 
Then you have to clean these up, so they don't fill up the disk.
 
    Create a cron job:
 
        find /tmp/ . -name "*.sh_history*" -atime +10 exec rm {} \;
 
    to remove them
 
        Stuart

Stuart Abramson | Off: 412/825-1434 | Cell: 412/417-1567 | email:
sabramson@wabtec.com

-----Original Message-----
From: Binkley Robert - rbinkl [mailto:Robert.Binkley@acxiom.com]
Sent: Thursday, July 17, 2003 12:00 PM
To: Hpux-Admin (E-mail)
Subject: [HPADM] Security Tracking

Hello Admins
  I have been given a task , on monitoring one of out credit customers
boxes.
  The problem I am faced with is that, The customer wanted to know if there
is a way to track each users .sh_history for rmdir or rm* or rm -rf and log
the information in a file.
 
 

---------------------------------------------------------------------

**********************************************************************
The information contained in this communication is
confidential, is intended only for the use of the recipient
named above, and may be legally privileged.
If the reader of this message is not the intended
recipient, you are hereby notified that any dissemination,
distribution, or copying of this communication is strictly
prohibited.
If you have received this communication in error,
please re-send this communication to the sender and
delete the original message or any copy of it from your
computer system. Thank You.

***** CONFIDENTIALITY NOTE *****
The content contained in this e-mail transmission is legally privileged and
confidential information intended only for the use of the individual or
entity named herein. If the reader of this transmission is not the intended
recipient, you are hereby notified that any dissemination, distribution, or
copying of this transmission is strictly prohibited.

--
             ---> Please post QUESTIONS and SUMMARIES only!! <---
        To subscribe/unsubscribe to this list, contact majordomo@dutchworks.nl
       Name: hpux-admin@dutchworks.nl     Owner: owner-hpux-admin@dutchworks.nl
 
 Archives:  ftp.dutchworks.nl:/pub/digests/hpux-admin       (FTP, browse only)
            http://www.dutchworks.nl/htbin/hpsysadmin   (Web, browse & search)

• Previous message: Binkley Robert - rbinkl: "[HPADM] Security Tracking"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]