Re: Monthly security run.

2004-06-05 Thread Viktor Lazlo
On Tue, 1 Jun 2004, jimmie james wrote:

> Doing login accounting:
> total 1438.65
> jimmie 1435.18
> root 3.46
>
> This all makes perfect sense, though I was wondering,
> if there's an easy way to get the script to log how
> many times (and optionally, who) uses "su" or "su -"
> and to what account they jumped to.
>
> Unfortunaly, I'm not a code monkey, so digging around
> in the source, and trying myself would probably break
> something.

You can do this easily enough by polling /var/log/messages for any use of
su:

grep -i su /var/log/messages | sort +6

Set this up as a daily crontab item and the results will be emailed to you
automatically.

Cheers,

Viktor
___
[EMAIL PROTECTED] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "[EMAIL PROTECTED]"


Monthly security run.

2004-06-01 Thread jimmie james
Doing login accounting:
total 1438.65   
jimmie 1435.18
root 3.46

This all makes perfect sense, though I was wondering,
if there's an easy way to get the script to log how
many times (and optionally, who) uses "su" or "su -"
and to what account they jumped to.

Unfortunaly, I'm not a code monkey, so digging around
in the source, and trying myself would probably break
something.

It's just an idea.

Jimmie.





__
Do you Yahoo!?
Friends.  Fun.  Try the all-new Yahoo! Messenger.
http://messenger.yahoo.com/ 
___
[EMAIL PROTECTED] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "[EMAIL PROTECTED]"