1

We are in a banking enviornment and our core system is based on AIX. Multiple users are logging in with the same userID at the same time using SSH. I know I can see who SSHed into the system from which IP, but the concern is that how can we audit what each user with this default userID did during their sessions.

The problem this core system is working this way only even after we contacted the vendor. It is very critical to audit what each user did with this userID while they are logged in the same time. Is there a way to differentiate between session IDs for the users?

2

Multiple users are logging in with the same userID at the same time using SSH.

Honestly your simplest fix is probably going to be arranging for every person to log in under THEIR OWN USERID and doing their work that way. If they need to run an application as a particular user then give them the ability to run the command over sudo as in:

sudo -u <groupusername> /path/to/command. 

This will log the action in the system log if sudo is set up properly, and sudo has some reasonably good extended logging available.

You can get really granular with sudo. It's pretty useful for this.

If nothing else you can set up the workflow such that people ssh into the server then sudo su - which will give you a better chance of tracing them over time.

The problem with setting up the history file is that it can trivially be whacked by a user since it's owned by that user.

From a brief reading of the AIX auditing it looks like it will audit per user and not per login. However ICBW about that. I'd still turn it on.

So in my opinion (and while I don't sell myself as a security expert, I do have a CISSP and maintain the Continuing Education related to that certification) you need to get in touch with your security department and determine what, if any, compliance standards need to be met (In the US I'd expect a bank to have to meet at least Dodd-Frank, PCI and SoX), and what needs to be done to bring your system into compliance with that.

I would then take this list to management and explain that these weren't really optional in today's environment and that there could be rather expensive fines/fees levied if you aren't up to snuff and let them decide how to go forward.

In the mean time I'd turn all my logging up to 11, and start crawling through it looking for ways to correlate what it's telling me. On AIX, especially with the auditing turned on you might be able to compare events across several log files.

As a trivial example a long time ago I got a Technical Support call wanting to know why a particular server had "crashed". I spent about 30 seconds digging through the logs when I noticed that at T - 5 someone had logged in as "root" (bad idea to have that open) and then the shutdown command had been issued.

"Oh. That must have been my partner. Never mind." "Can I close the case?" "Yeah".

The problem with this is that should you wind up in a criminal case where your correlations are part of the evidence...Oh Boy. I'd not want to be in that position.

0

I have two suggestions:

  1. Set up separate history files with something like:

    HISTFILE=$HOME/.sh_history.$$

or some variation using $SSH_CONNECTION or other environmental variables.

  1. Enable AIX auditing.

If it's critical enough, you could connect a 3rd-party tool to the auditing system to offload the command executions to a remote system. Otherwise, a local administrator could undo either of these suggestions.

0

I suggest the following liks

http://www.ibm.com/developerworks/aix/library/au-audit_filter/ www.redbooks.ibm.com/redbooks/pdfs/sg246020.pdf (Redbook)

Also you can configuring the IBM The Audit Subsystem. https://www.netiq.com/documentation/change-guardian/changeguardianuserguide/data/b13v6jsc.html

You could also specify their history file in the /etc/profile with a few lines like these: HISTSIZE=10000 mkdir -p $HOME/.history HISTFILE=$HOME/.history/.history.$(date +%Y%m%d.%H%M%S).$$ This would keep 10,000 events in a uniquely named history files with the date they logged in included in the name of the file.

I hope this tips hep you.

Regards. AL

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.