1

How many ways to log to a Linux machine there are?

  1. Direct login, using connected keyboard :)
  2. Remote login via ssh (-Y) to console or GUI

is there any other means - defaultly allowed, or enabled in some distributions, or just commonly known - except those two ? Surely, one can replace getty with some program allowing other means of access but this is not the case.

Since we were told to create IT account with root privileges, i'd like to know how should I know what changes were made to system, what should i log or check? I've read about rootsh, but one with root can simply escape that shell. Data from last command can be cleaned. Other than that what could i do, except from informing myself via mail, that a remote login took place, and know what changed?

closed as too broad by Zelda, Anthon, slm, rahmu, manatwork Jan 19 '14 at 14:37

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • Related, but does not answer the question. Actually it even says "I don't know if you'll ever find a precise definition that everyone agrees on." about login in the first place. unix.stackexchange.com/questions/101365/… – user57111 Jan 19 '14 at 11:28
  • Another related thing. It appears that one can login to normal user account, and then use "superpowers" to access root privileges. 1. su 2. sudo 3. pkexec env DISPLAY=$DISPLAY XAUTHORITY=$XAUTHORITY xterm # or gnome-terminal askubuntu.com/questions/376932/… – user57111 Jan 19 '14 at 11:32
5

How many ways to log to a Linux machine are there?

Lots:

  1. Machine console. (What you call "connected keyboard," though that's too generic a term, as you will see.)

  2. SSH

  3. Telnet

  4. RSH

  5. rlogin

  6. Serial terminal

  7. Telephone modem [*]

  8. XDMCP

  9. VNC, NX, LogMeIn, GoToMyPC, TeamViewer and dozens more remote desktop systems

  10. And a million more, lacking only someone willing to code them up.

i'd like to know how should I know what changes were made to system, what should i log or check?

Your system may have some kind of auditing system set up.

Failing that, you can look into Tripwire, AIDE or similar.

what could i do, except from informing myself via mail, that a remote login took place, and know what changed?

If you give someone full root access to the system, you cannot reliably know what has changed if you only use the system's own resources to try and discover what happened in the past. This is why hackers use the term "pwn" — one's mastery of a pwned system is limited only by one's creativity and skill.

The only solutions to this are:

  1. Give only partial access, as is possible with careful configuration of sudo, SELinux, AppArmor or other MAC systems; or

  2. Set up some kind of external tamper-proof monitoring, like off-machine logging, etc.


[*] A telephone modem configured to answer incoming calls and accept logins is just a special case of serial terminal, really, but is different enough from a directly-connected serial terminal to list it separately.

  • Agree, there are lots. But arent they just a variation of same thing ? By that i mean, rlogin, and RSH need to be explicity enabled, or actually deamon must be present to service that connections on local machine, am I right ? So, knowing that (presently, that is) i'm not running them, then besides legitimate ways of logging (not counting using unknown to me exploits), there are no other means. I'm not quite sure how one would login for example via serial. Connect serial-serial to machine, but still would need to be greeted by some program, right? – user57111 Jan 19 '14 at 11:48
  • If your point is that SSH, telnet and XDMCP are all types of network connections, it is your privilege to lump them all together. I happen to think of them as very different things, as is my privilege. – Warren Young Jan 19 '14 at 11:51
  • Re: serial console: The Linux Serial Console HOWTO – Warren Young Jan 19 '14 at 11:52
  • Well, aren't they types of network connections ? I mean, perhaps it is possible to login via other means than through RJ45 to ssh, but with my state of knowledge i cannot imagine how :) – user57111 Jan 19 '14 at 11:56
  • How long is a piece of string? – Warren Young Jan 19 '14 at 12:00

Not the answer you're looking for? Browse other questions tagged or ask your own question.