Solved

How to track root actions through GUI?

Posted on 2000-05-09
4
325 Views
Last Modified: 2013-12-27
From my previous post, I know how to trace a person's command history. But how do I do so if the root uses GUI instead of command-line?

I need to track my sysadmin's actions whenever he uses the GUI for Checkpoint FW-1 (for firewall maintenance) and OpenWindows (for accounts maintenance).

The firewall server is running on Solaris 2.6

If there are any 3rd party utilities, please include their URL as well. Thanks in advance.
0
Comment
Question by:heemeng
4 Comments
 
LVL 40

Expert Comment

by:jlevie
ID: 2792224
Basically you can't log someones actions when they are manipulating a GUI interface. All that could possibly be captured external to the application would be the mouse location (in screen coordinates) and any text typed in. That would be of little use without knowing what part of the GUI the mouse had been over. It would be up to the application to provide a history logging mechanism. Firewall-1 might be able to do that, but I don't think that AdminSuite or admintool does.

You could use a video splitter to have the monitor of interest displayed on a second monitor for viewing. Or run a "record & playback" screen capture application (but the log files will be huge).
0
 
LVL 15

Expert Comment

by:samri
ID: 2792495
heemeng,

If you are really interested to know everything a user (or administrator) on your system is doing, I bet you can turn on ACL on each of the file on your server.  I think that you can have a very detail logging (and HUGE log file).

Just a coment.

0
 

Accepted Solution

by:
roy911 earned 150 total points
ID: 2793125
Since it is not really feasible to capture commands issued from a GUI - I would suggest that you setup a specific userid (root in your case), that can run the GUI. Ensure that a user cannot log in directly as the user, but has to su to it - that way you will have a sulog of the user who logged on. Also, the GUI in question *will* be updating certain logs that reflect changes made via the GUI. You should isolate these logfiles and run scripts against these logfiles to generate appropriate reports for you to look at on a daily basis. The software vendor will be the right person to contact to find out which logfiles get updated.
0
 

Author Comment

by:heemeng
ID: 2795002
Thanks guys for the comments.
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

I have been running these systems for a few years now and I am just very happy with them.   I just wanted to share the manual that I have created for upgrades and other things.  Oooh yes! FreeBSD makes me happy (as a server), no maintenance and I al…
FreeBSD on EC2 FreeBSD (https://www.freebsd.org) is a robust Unix-like operating system that has been around for many years. FreeBSD is available on Amazon EC2 through Amazon Machine Images (AMIs) provided by FreeBSD developer and security office…
Learn several ways to interact with files and get file information from the bash shell. ls lists the contents of a directory: Using the -a flag displays hidden files: Using the -l flag formats the output in a long list: The file command gives us mor…
This video shows how to set up a shell script to accept a positional parameter when called, pass that to a SQL script, accept the output from the statement back and then manipulate it in the Shell.

930 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now