Solved

RHEL su logging

Posted on 2013-01-24
7
218 Views
Last Modified: 2013-02-01
My system has RHEL 3,4,5. If 2 users su to another account at the same time, how do I log activities of each user after su? Does audit.log log this scenario? This is needed to provide traceability and accountability for the system security.
0
Comment
Question by:Elyutah
  • 3
  • 2
  • 2
7 Comments
 
LVL 31

Expert Comment

by:farzanj
Comment Utility
Check the log

/var/log/secure

Users should use sudo to su to other users.  Sudo keeps logs for any  commands issued.  However for RHEL3 sudo is too old and will not log very well.
0
 

Author Comment

by:Elyutah
Comment Utility
/var/log/secure only logs when the users su to another account, but not commands issued by them after they become another user.
0
 

Author Comment

by:Elyutah
Comment Utility
The problem with using sudo su is that X11 being disabled. The users need to bring up a GUI to run the system.
0
Do You Know the 4 Main Threat Actor Types?

Do you know the main threat actor types? Most attackers fall into one of four categories, each with their own favored tactics, techniques, and procedures.

 
LVL 31

Expert Comment

by:farzanj
Comment Utility
GUI control will be based on your desktop.  What kind of desktop do you have?

Sudo will still work really good with GUI.  You said the users need to execute commands, they don't need to get to the GUI of other users.  In their GUI command prompt, they can still issue commands using sudo for some other user.  They do not need to login as another user.  All the commands will thus be logged.  Making sense?
0
 
LVL 76

Expert Comment

by:arnold
Comment Utility
What reason would an Admin need to run commands as another user (presumably not elevated rights)?
Could you provide the scenario you are dealing with?

how is the user who will be running those commands interfaces with the system?
i.e. the user using GUI to login, then opens a terminal/xterm window
runs sudo/su and then would like a graphical command sent back to the desktop?
You could use xhost + or set DISPLAY to redirect the SUDO/SU GUI back to the desktop
export DISPLAY=localhost:0.0
0
 

Author Comment

by:Elyutah
Comment Utility
Here is the scenario: the original system used a group account (ga) who a matlab license is granted. We are required to eliminate the ga by implementing individual user accounts. However, the matlab license is not going to be updated until later. In the mean time, the users need to switch to the ga and bring up a console GUI to run tasks required matlab.  We are approved to use 'su' but need to provide traceability. Other tasks can be done within the individual user accounts.
0
 
LVL 76

Accepted Solution

by:
arnold earned 500 total points
Comment Utility
Sudo is the tool to use with those users only have su - ga as the only permitted command
Run this command from an xterm and it should preserve the DISPAY .
0

Featured Post

Better Security Awareness With Threat Intelligence

See how one of the leading financial services organizations uses Recorded Future as part of a holistic threat intelligence program to promote security awareness and proactively and efficiently identify threats.

Join & Write a Comment

Network Interface Card (NIC) bonding, also known as link aggregation, NIC teaming and trunking, is an important concept to understand and implement in any environment where high availability is of concern. Using this feature, a server administrator …
Little introduction about CP: CP is a command on linux that use to copy files and folder from one location to another location. Example usage of CP as follow: cp /myfoder /pathto/destination/folder/ cp abc.tar.gz /pathto/destination/folder/ab…
Learn several ways to interact with files and get file information from the bash shell. ls lists the contents of a directory: Using the -a flag displays hidden files: Using the -l flag formats the output in a long list: The file command gives us mor…
Learn how to navigate the file tree with the shell. Use pwd to print the current working directory: Use ls to list a directory's contents: Use cd to change to a new directory: Use wildcards instead of typing out long directory names: Use ../ to move…

728 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

9 Experts available now in Live!

Get 1:1 Help Now