[no subject]

The name escapes me but there is a bash (may be others as well) logger
that support a remote "tee" process. Point this to an append-only
file-system on the remote system and you have a solid log of root
activity.

Another easy way is to make the /root directory a separate, append only
partition. This will put the.bash_history in append only mode. 

Hmm. That may be a problem as /root needs to be on the same partition
as /bin and /sbin in order to login in runlevel 1 for emergency issues.

RedHat recommends to make root shell /bin/nologin and use sudo. Runlevel
1 becomes impossible with out a boot disk, though.

On Mon, 2005-09-19 at 09:01 -0400, John Wells wrote:
> Guys,
> 
> We have a need to capture everything an admin does while logged in as root
> and another power login (postgres).  This is driven by a number of forces,
> not the least of which is Sarbanes Oxley.
> 
> Are there any tried and true (and secure) auditing solutions that offer
> this capability?
> 
> Thanks, as always.
> 
> John
> 
> 
> _______________________________________________
> Ale mailing list
> Ale at ale.org
&gt; <a  rel="nofollow" href="http://www.ale.org/mailman/listinfo/ale";>http://www.ale.org/mailman/listinfo/ale</a>
-- 
James P. Kinney III          \Changing the mobile computing world/
CEO &amp; Director of Engineering \          one Linux user         /
Local Net Solutions,LLC        \           at a time.          /
770-493-8244                    \.___________________________./
<a  rel="nofollow" href="http://www.localnetsolutions.com";>http://www.localnetsolutions.com</a>

GPG ID: 829C6CA7 James P. Kinney III (M.S. Physics)
&lt;jkinney at localnetsolutions.com&gt;
Fingerprint = 3C9E 6366 54FC A3FE BA4D 0659 6190 ADC3 829C 6CA7
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part



</pre>
<!--X-Body-of-Message-End-->
<!--X-MsgBody-End-->
<!--X-Follow-Ups-->
<hr>
<ul><li><strong>Follow-Ups</strong>:
<ul>
<li><strong><a name="00414" href="msg00414.html">[ale] Auditing root shells</a></strong>
<ul><li><em>From:</em> hbbs at comcast.net (Jeff Hubbs)</li></ul></li>
<li><strong><a name="00413" href="msg00413.html">[ale] Auditing root shells</a></strong>
<ul><li><em>From:</em> jb at sourceillustrated.com (John Wells)</li></ul></li>
<li><strong><a name="00427" href="msg00427.html">[ale] Auditing root shells</a></strong>
<ul><li><em>From:</em> mhw at wittsend.com (Michael H. Warfield)</li></ul></li>
</ul></li></ul>
<!--X-Follow-Ups-End-->
<!--X-References-->
<ul><li><strong>References</strong>:
<ul>
<li><strong><a name="00407" href="msg00407.html">[ale] Auditing root shells</a></strong>
<ul><li><em>From:</em> jb at sourceillustrated.com (John Wells)</li></ul></li>
</ul></li></ul>
<!--X-References-End-->
<!--X-BotPNI-->
<ul>
<li>Prev by Date:
<strong><a href="msg00410.html">[ale] Error uploading a file using a PHP webpage</a></strong>
</li>
<li>Next by Date:
<strong><a href="msg00412.html">[ale] problems with an Intel dual gig-e nic</a></strong>
</li>
<li>Previous by thread:
<strong><a href="msg00407.html">[ale] Auditing root shells</a></strong>
</li>
<li>Next by thread:
<strong><a href="msg00414.html">[ale] Auditing root shells</a></strong>
</li>
<li>Index(es):
<ul>
<li><a href="maillist.html#00411"><strong>Date</strong></a></li>
<li><a href="threads.html#00411"><strong>Thread</strong></a></li>
</ul>
</li>
</ul>

<!--X-BotPNI-End-->
<!--X-User-Footer-->
<!--X-User-Footer-End-->
</body>
</html>