[no subject]

Serial console is an excellent idea. I now recall from "The Cuckoos Egg"
the use of a serial console split on the wire to a line printer that was
used to capture the command during a breaking.

the tool sudosh (sourceforge) is a one-stop-shop for what is needed
here. It is shell agnostic and acts basically like a keystroke logger.
Admins ( even the whiney "sudo is too hard" ones) can access it with
"sudo sudosh" (make it the _only_ thing they can access by aliasing sudo
to it or setting it as the only allowed shell in /etc/shells).

It also has the sudosh-replay which allows a one to pick the admin and
replay their commands. Couple this with syslog being tee'ed to a remote
machine that is append only.

On Mon, 2005-09-19 at 09:53 -0400, Christopher Fowler wrote:
> On Mon, 2005-09-19 at 09:01 -0400, John Wells wrote:
> > We have a need to capture everything an admin does while logged in as
> > root
> > and another power login (postgres).  This is driven by a number of
> > forces,
> > not the least of which is Sarbanes Oxley.
> 
> There is the solution of using a serial console only as root and the
> serial console can log all console output to a separate server.
> Consider this screen capture of the console.
> 
> 
> _______________________________________________
> Ale mailing list
> Ale at ale.org
&gt; <a  rel="nofollow" href="http://www.ale.org/mailman/listinfo/ale";>http://www.ale.org/mailman/listinfo/ale</a>
-- 
James P. Kinney III          \Changing the mobile computing world/
CEO &amp; Director of Engineering \          one Linux user         /
Local Net Solutions,LLC        \           at a time.          /
770-493-8244                    \.___________________________./
<a  rel="nofollow" href="http://www.localnetsolutions.com";>http://www.localnetsolutions.com</a>

GPG ID: 829C6CA7 James P. Kinney III (M.S. Physics)
&lt;jkinney at localnetsolutions.com&gt;
Fingerprint = 3C9E 6366 54FC A3FE BA4D 0659 6190 ADC3 829C 6CA7
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part



</pre>
<!--X-Body-of-Message-End-->
<!--X-MsgBody-End-->
<!--X-Follow-Ups-->
<hr>
<ul><li><strong>Follow-Ups</strong>:
<ul>
<li><strong><a name="00423" href="msg00423.html">[ale] Auditing root shells</a></strong>
<ul><li><em>From:</em> cfowler at outpostsentinel.com (Christopher Fowler)</li></ul></li>
</ul></li></ul>
<!--X-Follow-Ups-End-->
<!--X-References-->
<ul><li><strong>References</strong>:
<ul>
<li><strong><a name="00407" href="msg00407.html">[ale] Auditing root shells</a></strong>
<ul><li><em>From:</em> jb at sourceillustrated.com (John Wells)</li></ul></li>
<li><strong><a name="00417" href="msg00417.html">[ale] Auditing root shells</a></strong>
<ul><li><em>From:</em> cfowler at outpostsentinel.com (Christopher Fowler)</li></ul></li>
</ul></li></ul>
<!--X-References-End-->
<!--X-BotPNI-->
<ul>
<li>Prev by Date:
<strong><a href="msg00418.html">[ale] Error uploading a file using a PHP webpage</a></strong>
</li>
<li>Next by Date:
<strong><a href="msg00421.html">[ale] Auditing root shells</a></strong>
</li>
<li>Previous by thread:
<strong><a href="msg00417.html">[ale] Auditing root shells</a></strong>
</li>
<li>Next by thread:
<strong><a href="msg00423.html">[ale] Auditing root shells</a></strong>
</li>
<li>Index(es):
<ul>
<li><a href="maillist.html#00419"><strong>Date</strong></a></li>
<li><a href="threads.html#00419"><strong>Thread</strong></a></li>
</ul>
</li>
</ul>

<!--X-BotPNI-End-->
<!--X-User-Footer-->
<!--X-User-Footer-End-->
</body>
</html>