History of the Root Account Tracking User Activities

..... .....

8.4.3.2 History of the Root Account

A simple way to retain some information about superuser activity is to enable a root history mechanism the C and Korn shell allow the history through the superusers login initialization files. For example, for the C shell: set history =200 set savehist = 200 A list of the last 200 commands will be saved in the file .history.

8.4.3.3 Tracking User Activities

Other UNIX commands are also available for tracking what users have been doing in the system. They can sometimes track down the cause of a security problem. Some of these commands are: Command UNIX versions Displays information on: last BSD, System V, AIX User login sessions – based on the wtmp file lastcomm BSD, System V, AIX All commands executed by user and TTY – based on the pacct file acctcom System V, AIX All commands executed by user and TTY acctcms System V, AIX All commands executed by time of day All of the commands listed find their information in the system accounting files; in the past, to use these commands, the accounting subsystem had to be running. Today, the wtmp file is a standard raw log file independent of the running accounting subsystem. Generally, if accounting is activated on the system, the possibilities for tracking users and system activities are higher. This makes sense, given the basic idea of accounting, which is to collect more data on how and by whom a system is used. 204

Chapter 9: UNIX Logging Subsystem

9.1 The Concept of System Logging

UNIX provides a flexible and configurable logging mechanism. The logging can be site−customized to fulfill a wide range of requirements with regard to the volume and level of the logging of system messages. Continuous system logging is provided primarily to enable later analysis of the system behavior when the system encounters problems. Appropriate system logging is essential on every UNIX system. A side effect of such continuous logging is the permanent growth of the number of log files, which requires attention by the system administrator. System logging originated with BSD UNIX, and today is widely accepted on all UNIX platforms. The system message logger runs as a special daemon syslogd that collects messages sent by various system processes and routes them to the defined logging destinations. The syslogd daemon is started at boot time, and its behavior is defined by its configuration file etcsyslog.conf. A flexible syslogd configuration allows the administrator to choose from a wide range of system logging options from no logging at all to very verbose logging. The logging can also be tuned and changed throughout the lifetime of the system, enabling different levels of logging according to actual needs. This logging flexibility is achieved by specifying three different logging issues: What to log, by selecting a logging facility that indicates a subsystem a suite of processes that generates a log message. 1. How to log, by selecting a logging level that indicates a severity, or priority level, of the generated message to be logged. 2. Where to log, by selecting a logging destination which indicates an action to be taken to log a generated message. The generated message can be logged in a local file, forwarded to the console or users, or forwarded to a remote logging system for further processing. 3. The available logging facilities are: user User processes kern The kernel mail The mail system daemon System daemons, such as telnetd, ftpd, etc. auth The authentication authorization system: login, su, getty, etc. lpr The printer spooling system: lpr, lpc, etc. cron The cronat facility: crontab, at, cron, etc. local 0–7 Reserved for local use mark For timestamp messages produced internally by the syslogd daemon news Reserved for the USENET network news system uucp Reserved for the UUCP system An asterisk indicates all facilities except for the mark facility The defined severity priority levels the highest levels are at the top are: emerg For panic conditions, such as catastrophic failures alert For conditions that should be corrected immediately, such as a corrupted DB 205