1

I installed the package audit on my linux red-hat 6.x machine in order to view the recored of each user that log to my linux machine

yum install audit

kit installation from: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Security_Guide/sec-installing_the_audit_packages.html

after installation and restart the audit service as

service auditd start

I follow the audir.log file in order to see the users records

tail -f /var/log/audit/audit.log 

but from this log I see only the User IP's and when he login to my linux machine

the records of the linux command that user perfromed not apperars in the audit.log

can some one advice why we not see the history of linux command in audit.log?

example of audit.log

type=USER_START msg=audit(1422876162.936:152): user pid=28114 uid=0 auid=0 ses=74236 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=10.1.113.35        addr=10.1.113.35 terminal=ssh res=s'
type=USER_LOGIN msg=audit(1422876162.940:153): user pid=28116 uid=0 auid=0            ses=74236 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=10.1.113.35            addr=10.1.113.35     terminal=/dev/pts/1 res=success'
type=USER_START msg=audit(1422876162.940:154): user pid=28116 uid=0 auid=0 ses=74236 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=10.1.113.35 addr=10.1.113.35 terminal=/dev/pts/1 res=success'
type=CRYPTO_KEY_USER msg=audit(1422876162.940:155): user pid=28116 uid=0 auid=0 ses=74236 msg='op=destroy kind=server fp=99:c8:56:79:64:17:0b:67:b5:6c:e9:36:22:8a:b1:88 direction=? spid=28116 suid=0 '
type=CRYPTO_KEY_USER msg=audit(1422876162.940:156): user pid=28116 uid=0 auid=0 ses=74236 msg='op=destroy kind=server fp=6f:b9:bf:4f:84:1f:58:e5:d2:1c:94:1f:11:8e:26:61 direction=? spid=28116 suid=0 '
type=CRED_REFR msg=audit(1422876162.940:157): user pid=28116 uid=0 auid=0 ses=74236 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=10.1.113.35 addr=10.1.113.35 terminal=ssh res=success'
  • remark in case this tool Audit can't do the records of each user , please help me to find other tool that can do the Job
1

Maybe it takes more effort than using some external tools, but last or utmpdump supply all the needed remote login info using those files (read http://xmodulo.com/monitor-user-login-history-centos-utmpdump.html for more info about those files):

/var/log/wtmp  
/var/log/btmp
/var/run/utmp

and as it was said above you can handle the user-shell-command-history recording on your own.

  • the link not explain how to view what user type on linux machine ( history ) – maihabunash Feb 2 '15 at 18:16
  • No it only explains about the login recordings without any external tool. To trace user commands, you should use user's shell history files. The other answer links describes how to do this – csny Feb 3 '15 at 7:40
0

Isn't the login data alredy available in auth.log without additional packages?

command-history is the matter of shell, to record it, you must patch the shell (all shells on the system) with a feature that records every line of input (but if the user really wants to escape the logging, he can always find a way). That's because every application (not just a shell) can fork and execute any command it wishes. So the only foolproof way is to record every process it is started on your system (see the second link below). However, that still excludes everything that is done by the shell that doesn't require a new process to be spawned (all shell builtins) - someone could in principle call echo "malicious command" | bash and only bash will be visible as commandline. So both shell logging and exec logging is probably the way to go.

Relevant links:

https://stackoverflow.com/questions/15698590/how-to-capture-all-the-commands-typed-in-unix-linux-by-any-user User's executed commands log file

0

You could use process accounting too. Look for service psacct on Fedora and enable it.

Then you can see what user did/is doing by running things like:

sa  (list of all commands)
lastcomm bash  (who ran bash)
lastcomm vpathak   (what was run by vpathak)

This along with some shell history should give you a nice outline.

For better understanding of where logins come from and what keys are used, you can also view a detailed step wise intrusion attempt investigation at http://vpathak.tumblr.com/post/121343814158/fedora-audit-log-with-love-from-russia

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.