The tag has no usage guidance.

learn more… | top users | synonyms

3
votes
0answers
64 views

How to best track adventures of a novice administrator

I have this user that has limited sudo privileges, yet he manages to screw up from time to time. I would like to keep an eye on his adventures, so that I can reverse any damage with less digging. ...
2
votes
2answers
34 views

Is there a way to tell how a user authenticated their SSH connection ? i.e. whether it was by password or by public key?

I'm locking down my server to use public-key only. I just want to make sure before I flip the switch that all my users have already made the transition, and nobody is left using passwords to log in.
1
vote
0answers
41 views

groupadd failure: “Cannot open audit interface”

I'm trying to add a group in a chrooted environment: root@my-host:/# /usr/sbin/groupadd -g 101 games Cannot open audit interface - aborting. I'm operating with root permissions. Additional info: ...
2
votes
1answer
87 views

Password protecting Single User Mode and GRUB on a VPS

I have a VPS CentOS 6 Linux web server. It is run on KVM. Running a Lynis audit, it notes that single user mode and GRUB are not protected by any password/authentication: [16:00:28] Warning: No ...
2
votes
1answer
49 views

Non-root privileged user to find all files with SUID & SGID bit…Permission Required?

I'm writing an audit script to find all files with SUID & SGID bit set on the system, using the below command: find / perm /u=s,g=s The script will run with a non-root user. Will this user be ...
3
votes
1answer
139 views

How to find which process is currently writing to the disk?

For some unknown reason there is no space left on my /, even 5 minutes after removing 300 MBs of junk packages, there is no space left again. So I've come to conclusion that there is some process that ...
0
votes
1answer
33 views

Compare Linux configuration with default

My system fails to upgrade. I suspect it was breached. Is there a way to compare system configuration to default version that should be at this date and kernel version? My current system is Debian, ...
2
votes
1answer
163 views

How to audit access to any file or folder within a given path for specific user

I've been reading some information about configuration of auditd and I just can't figure this out, what I know how to do Log specific system calls by a user Log access to a specific file by all ...
2
votes
1answer
100 views

To be SOX compliant I need to keep years worth logs. Need help with particuliars

My company is going through an audit and I have taking over the role of Linux systems administrator unofficially. I see our current logging system has it to were we basically keep a months worth of ...
1
vote
0answers
227 views

tracking directory permission changes

Permission of a certain directory named 11203 got changed twice bcoz of which the hosted app encountered some problems. When i used the command.. ausearch -i |grep chmod |grep 11203 I got the ...
3
votes
0answers
347 views

How to disable sudo related logging for successful command execution under CentOS/Fedora?

You can disable sudo related log messages via adding something like Defaults:juser !syslog to our sudoers file. That is disabling logging to syslog. But under e.g. CentOS/Fedora there is an auditd ...
4
votes
1answer
199 views

How to log all system calls made by a process and all its descendants with auditd

I can do auditctl -a always,exit -S all -F pid=1234 To log all the system calls done by pid 1234 and: auditctl -a always,exit -S all -F ppid=1234 For its children, but how do I cover the ...
1
vote
0answers
135 views

File path in audit log instead of inode number

When I do: echo "#TEST" >> /etc/passwd I get the following in audit logging: node=kayak.office.local type=SYSCALL msg=audit(1412687666.054:62033): arch=c000003e syscall=2 success=yes ...
0
votes
1answer
116 views

automatically copy file from local server to remote server after login over ssh

I need to know how to copy a file from local server to remote server automatically after login using ssh. actually In my local server so many users are there with their local userid . but they will ...
1
vote
1answer
214 views

Who is user “unset” in aureport?

I couldn't find this elusive "unset" user in /etc/passwd and there is no mention of him in man aureport although she scored the most number of hits on my audit log: # aureport -u -i --summary --start ...
0
votes
0answers
34 views

third party linux auditing software

Linux has a audit system built-in in its kernel and a user space process called auditd reading the system calls intercepted by the kernel. Are there alternate solutions to the Linux Audit system ? I ...
2
votes
1answer
73 views

How to extract a list of user accounts deleted from the system over a period of 1 year? [closed]

I'm auditing an AIX and a Linux system and I would like to know how many user accounts were created and deleted over a 1 year period. Is there some way of getting this data from the Unix system?
6
votes
1answer
1k views

Why do I get “Permission Denied” errors even though I have group permission?

I'm trying to run a game called "Dofus", in Manjaro Linux. I've installed it with packer, that put it under /opt/ankama folder. This folder ownership (and for every file inside it) is root user, and ...
3
votes
1answer
56 views

Recover atime after vim

I've vimed a file, and only afterwards realised that I need the atime (last access time) for the file. Is there any way to recover the atime for a file after accessing it inadvertently? The ...
2
votes
1answer
159 views

Unix Useradd - Audit list of users added to system [duplicate]

I would like to understand how could I pull out a list of users that have been added with certain privileges to a Unix system over a certain period of time. Now, I understand one way to go about ...
2
votes
1answer
846 views

Bandwith Usage in OpenVPN

Is there any way to check how much bandwidth a user used in OpenVPN (using PAM Authentication)
1
vote
0answers
94 views

What config changes are being tracked by aureport?

I am interested in using aureport to audit my server. When I run: # aureport -c It gives the following output: =================================== # date time type auid success event ...
6
votes
2answers
294 views

How do I view executables run by a program?

Is there a way to view or get a list of executables that a program uses? A particular example is file-roller. Is there a way to see which executables it uses, if there is more than one executable it ...
3
votes
1answer
1k views

Monitoring Linux user activities and auditing them

var/log/secure provides us below information : Mar 20 08:07:07 testing sshd[29749]: Accepted password for oracle from 10.51.1.12 port 49239 ssh2 Mar 20 08:07:07 testing sshd[29749]: ...
2
votes
2answers
238 views

is there a audit tool to track package installs and kernel version

I'm currently diagnosing a problem that started about a week ago on my laptop (running Ubunutu). The exact issue is not relevant though. Because I was already running several locally built kernel ...
0
votes
1answer
9k views

(CentOS) default FTP (SFTP) Log File?

I'm on CentOS v6.4 and using its native FTP Server, which i suppose is sftp. (Am i right?) Now i can use FTP well. But i need to log the actions taken by Users. Logs for the actions, such us, who ...
2
votes
2answers
2k views

dmesg filled with audits every minute from cron

My dmesg is filled with output of like the following, starting from a couple of seconds after booth and continuing indefinitely: [ 3155.216230] type=1006 audit(1393236841.859:85): pid=4206 uid=0 old ...
5
votes
0answers
149 views

audit activity on abstract domain sockets?

Using the audit system (auditd, auditctl) on Linux, is it possible to log connections to Unix domain sockets on the abstract namespace (or more exactly to filter them based on the (abstract) path)? ...
3
votes
2answers
4k views

Log every command typed in any shell: output (from logger function to syslog-ng/journald) contains duplicate entries for commands?

I installed syslog-ng to use on my desktop (Gentoo 64bit, upgraded to systemd i.e. was OpenRC before, with Openbox and Slim only) with my normal user to log all commands I type in the shell (bash ...
3
votes
1answer
889 views

Root complete history commands

Where can I get root's history except besides .sh_history? I've gotten some information but only from .sh_history and the history command.
6
votes
1answer
168 views

Automatic logging of scripts executed by users

That's a recurrent question of my workmates. We are a team of many people which works in the same Unix and Linux servers. The recurrent questions is if there are a log or something similar by default ...
1
vote
2answers
410 views

How to determine what user was used to start Apache Tomcat last (or last few times)

On a Mac, or a Linux Tomcat install, how do I determine what user was used last to start Tomcat? Is there information in the logs somewhere to that effect? Assume that startup.sh and shutdown.sh are ...
4
votes
2answers
467 views

How to interpret the “saddr” field of an audit log?

I'm trying to log the parameter of connect, so I added one rule with auditctl. Now in audit.log I get lines like this: type=SOCKADDR msg=audit(1385638181.866:89758729): saddr=hex string So how ...
0
votes
1answer
77 views

auditctl reports “File system watches not supported” on a very old system

When I run auditctl -l I got: # auditctl -l No rules File system watches not supported And I've already have AUDITSYSCALL enable in kernel, # zgrep AUDIT /proc/config.gz CONFIG_AUDIT_ARCH=y ...
5
votes
1answer
117 views

How do I find the full history of a file?

I need to know the full history of a file, like if someone changed or moved it to some other places since the time when it is created.
5
votes
0answers
97 views

Logging violations of rules in limits.conf [duplicate]

I'm trying to log the details of the programs that where failed due to the limit cap defined in the limits.conf. My initial plan was to do it using the audit system. The idea was to track the system ...
1
vote
1answer
254 views

Is there a way to see which process invoked a shell script?

Is there a possibility so see from some unix log file what process have invoked a bash/ksh shell script or is this shell script invoked manually from command line? So is there some log file which ...
4
votes
2answers
3k views

Is there an easy way to log all commands executed, including command line arguments?

I am trying to find how to log a specific instantiation of rrdtool to see whether the path it is receiving is incorrect. I know I could wrap the executable in a shell script that would log the ...
3
votes
3answers
361 views

How do I know if acct is running? (The Unix system accounting)

I have installed the acct package and it is running because I can see file activity in the log file. I know there is the command accton on to turn it on, but how do I determine that its running short ...
7
votes
3answers
908 views

Uncover sudoer user with root privileges which ran command X?

I'm the main sysadmin of a system. In the system there are 3 sudoers users with root's privileges. The system runs a script in background which check the hash of system's utilities to detect possible ...
4
votes
4answers
537 views

Are commands executed through SSH transparent to a remote host's administrator?

Can administrators know what commands I execute non-interactively through SSH? For example: does echo hello get logged somewhere at remote if I run this? $ ssh me@remote "echo hello" Can remote ...
2
votes
2answers
203 views

Is there some way to find out if/when an executable was called?

I'm trying to figure out whether AUCTeX is actually calling dvipng when it renders LaTeX previews. While this may not the best way to find this out, one possibility is to check whether the executable ...
3
votes
0answers
72 views

Is there a tool for seeing audit events as they happen without writing them to the disk?

Linux has an audit system that is usually used together with auditd, a daemon that, as far as I know, is designed for logging all events to the disk. However, I would like a way to directly get the ...
4
votes
2answers
352 views

Understanding getlogin()

I think the previous iteration of this question was a little bit like a carpet bomb of questions, so that may have turned people off to it (to the point of almost being flagged for removal) so I'll ...
1
vote
2answers
106 views

Auditing Linux: tell me to what IPs a connection was established

I need a command, or something that runs as a cron job, that logs what IPs my machine is communicating with, what ports, and what process did it.
4
votes
2answers
685 views

Proper syntax for “id -r” command

I'm trying to see if id -r will print out the UID or username of the user who logged into the system despite any su's or sudo's. I'm interested in doing this so I can keep people a little more ...
1
vote
2answers
433 views

How to find responsible script with ausearch results?

So I wanted to know which process is creating a directory ']' in my root. I was assuming this is some typo in some script. So I set up an audit for that directory, very similarly as shown on This ...
0
votes
1answer
27 views

Auditing of gdb commands

Is there a way I can log all gdb commands executed by a user? And do user level logging? Is any other tool like gdbserver can help in this case ?
0
votes
0answers
18 views

audit dir content removing / deletion [duplicate]

Possible Duplicate: Is it possible to find out what program or script created a given file? A peasant needs thunder to cross himself and wonder. A few minutes I get lost wp blog content the ...
6
votes
2answers
1k views

Is it possible to know who visited my home directory?

Suppose there are many users in a Linux cluster, each of them has his own HOME directory under /home/xxx, with xxx being his user name (or account). If the initial system configuration allows these ...