RE: Seeing who has su-ed

From: Shackleford, Dave (znz1@cdc.gov)
Date: 03/25/03

  • Next message: Jeremy Gaddis: "RE: latest ptrace hole patch?"
    From: "Shackleford, Dave" <znz1@cdc.gov>
    To: "'Klotz, Brian '" <Brian_Klotz@heald.edu>
    Date: Mon, 24 Mar 2003 20:40:50 -0500
    
    

    On 14:25 20 Mar 2003, Klotz, Brian <Brian_Klotz@heald.edu> wrote:
    | I teach a Linux basics course and each term I have the problem of
    students
    | who do an su to become root, then rather than exiting, they su again
    to go
    | back to their regular account. The trouble is identifying when
    someone has
    | done this (they usually don't remember). The "who" command only shows
    login
    | shells (AFAIK) so it does not reveal when someone has su-ed.
    |
    | Does anyone know of a way to list all of the users currently logged
    in,
    | including when someone has su-ed to become another user?

    As others have stated, this should be showing up in your /var/log/messages
    file. Running a simple:
    #cat /var/log/messages | grep su
    should do the trick w/out a problem. You could easily set this up as a cron
    job that saves to a file, such as :
    #cat /var/log/messages | grep su > /homedir/su.txt

    --Dave


  • Next message: Jeremy Gaddis: "RE: latest ptrace hole patch?"

    Relevant Pages

    • Re: Seeing who has su-ed
      ... | I teach a Linux basics course and each term I have the problem of students ... | who do an su to become root, then rather than exiting, they su again to go ... That neatly shows the process tree and the users of each process. ...
      (Focus-Linux)
    • Re: Seeing who has su-ed
      ... > I teach a Linux basics course and each term I have the problem of students ... Mar 21 12:45:18 xx su: Authentication failed for alvin ... and if i su - root ... ...
      (Focus-Linux)
    • Re: Sudo with two users
      ... by a group of competent students. ... > able to get root access on their own, group two, which would be the ... electronically approve/sign each issue/problem they are working. ...
      (comp.os.linux.misc)
    • Re: SUDOERS: how to setup in a school
      ... > I'm teacher of a Linux course, and I'm using Fedora Core 2 to teach ... > to login using ROOT user or a user created with ROOT privileges, ... Grant the students privelege to the contents of this directory. ...
      (comp.os.linux.security)
    • RE: Training Lab Question
      ... maintain a -unique- root, and the students should have that root on their ... Subject: Training Lab Question ... What is the best/safest way to allow the students to run ... This list is provided by the SecurityFocus Security Intelligence Alert ...
      (Pen-Test)