[no subject]

On Mon, 2005-09-19 at 12:46 -0400, Michael H. Warfield wrote:
> On Mon, 2005-09-19 at 09:23 -0400, James P. Kinney III wrote:
> > There are several that write a secure log either on the current machine
> > or a remote machine. sudo is the first thing that comes to mind. Be sure
> > to disable shell access from inside sudo (sudo /bin/sh will defeat the
> > logging of sudo commands).
> 
> > The name escapes me but there is a bash (may be others as well) logger
> > that support a remote "tee" process. Point this to an append-only
> > file-system on the remote system and you have a solid log of root
> > activity.
> 
> > Another easy way is to make the /root directory a separate, append only
> > partition. This will put the.bash_history in append only mode. 
> 
> > Hmm. That may be a problem as /root needs to be on the same partition
> > as /bin and /sbin in order to login in runlevel 1 for emergency issues.
> 
> > RedHat recommends to make root shell /bin/nologin and use sudo. Runlevel
> > 1 becomes impossible with out a boot disk, though.
> 
> 	It's worth noting that this conveys the full capacity of root to that
> admin while logging as that user.  This has pluses and minuses.  It
> certainly improves accountability.  But you are still left with the
> risks from a malicious system administrator (see the article at
&gt; &lt;<a  rel="nofollow" href="http://peerguardian.sourceforge.net/";>http://peerguardian.sourceforge.net/</a>&gt; and check out what's going on
&gt; with &quot;methlabs.org&quot;).  It may also break some logging if you are
&gt; specifically targeting &quot;root&quot; and not &quot;superuser activity&quot;.
&gt; 
&gt; 	If you are really REALLY serious about keeping tabs on system
&gt; administrators, look at Sebek &lt;<a  rel="nofollow" href="http://www.honeynet.org/tools/sebek/";>http://www.honeynet.org/tools/sebek/</a>&gt; and
&gt; log activity on another machine not under their control.  Not sure what
&gt; your level of need is, so this may be way over the top, but they will be
&gt; much less able to dick with this and, if they try, their initial
&gt; attempts would be captured even if they eventually circumvent it.
&gt; 
&gt; 	Mike
&gt; 
&gt; &gt; On Mon, 2005-09-19 at 09:01 -0400, John Wells wrote:
&gt; &gt; &gt; Guys,
&gt; &gt; &gt; 
&gt; &gt; &gt; We have a need to capture everything an admin does while logged in as root
&gt; &gt; &gt; and another power login (postgres).  This is driven by a number of forces,
&gt; &gt; &gt; not the least of which is Sarbanes Oxley.
&gt; &gt; &gt; 
&gt; &gt; &gt; Are there any tried and true (and secure) auditing solutions that offer
&gt; &gt; &gt; this capability?
&gt; &gt; &gt; 
&gt; &gt; &gt; Thanks, as always.
&gt; &gt; &gt; 
&gt; &gt; &gt; John
&gt; &gt; &gt; 
&gt; &gt; &gt; 
&gt; &gt; &gt; _______________________________________________
&gt; &gt; &gt; Ale mailing list
&gt; &gt; &gt; Ale at ale.org
&gt; &gt; &gt; <a  rel="nofollow" href="http://www.ale.org/mailman/listinfo/ale";>http://www.ale.org/mailman/listinfo/ale</a>
&gt; &gt; _______________________________________________
&gt; &gt; Ale mailing list
&gt; &gt; Ale at ale.org
&gt; &gt; <a  rel="nofollow" href="http://www.ale.org/mailman/listinfo/ale";>http://www.ale.org/mailman/listinfo/ale</a>
&gt; _______________________________________________
&gt; Ale mailing list
&gt; Ale at ale.org
&gt; <a  rel="nofollow" href="http://www.ale.org/mailman/listinfo/ale";>http://www.ale.org/mailman/listinfo/ale</a>



</pre>
<!--X-Body-of-Message-End-->
<!--X-MsgBody-End-->
<!--X-Follow-Ups-->
<hr>
<!--X-Follow-Ups-End-->
<!--X-References-->
<ul><li><strong>References</strong>:
<ul>
<li><strong><a name="00407" href="msg00407.html">[ale] Auditing root shells</a></strong>
<ul><li><em>From:</em> jb at sourceillustrated.com (John Wells)</li></ul></li>
<li><strong><a name="00411" href="msg00411.html">[ale] Auditing root shells</a></strong>
<ul><li><em>From:</em> jkinney at localnetsolutions.com (James P. Kinney III)</li></ul></li>
<li><strong><a name="00427" href="msg00427.html">[ale] Auditing root shells</a></strong>
<ul><li><em>From:</em> mhw at wittsend.com (Michael H. Warfield)</li></ul></li>
</ul></li></ul>
<!--X-References-End-->
<!--X-BotPNI-->
<ul>
<li>Prev by Date:
<strong><a href="msg00428.html">[ale] Auditing root shells</a></strong>
</li>
<li>Next by Date:
<strong><a href="msg00430.html">[ale] Sync a Palm Tungsten T5 with Linux</a></strong>
</li>
<li>Previous by thread:
<strong><a href="msg00427.html">[ale] Auditing root shells</a></strong>
</li>
<li>Next by thread:
<strong><a href="msg00417.html">[ale] Auditing root shells</a></strong>
</li>
<li>Index(es):
<ul>
<li><a href="maillist.html#00429"><strong>Date</strong></a></li>
<li><a href="threads.html#00429"><strong>Thread</strong></a></li>
</ul>
</li>
</ul>

<!--X-BotPNI-End-->
<!--X-User-Footer-->
<!--X-User-Footer-End-->
</body>
</html>