RE: Seeing who has su-ed
From: Shackleford, Dave (znz1@cdc.gov)
Date: 03/25/03
- Previous message: SB CH: "Re: latest ptrace hole patch?"
- Maybe in reply to: Klotz, Brian: "Seeing who has su-ed"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
From: "Shackleford, Dave" <znz1@cdc.gov> To: "'Klotz, Brian '" <Brian_Klotz@heald.edu> Date: Mon, 24 Mar 2003 20:40:50 -0500
On 14:25 20 Mar 2003, Klotz, Brian <Brian_Klotz@heald.edu> wrote:
| I teach a Linux basics course and each term I have the problem of
students
| who do an su to become root, then rather than exiting, they su again
to go
| back to their regular account. The trouble is identifying when
someone has
| done this (they usually don't remember). The "who" command only shows
login
| shells (AFAIK) so it does not reveal when someone has su-ed.
|
| Does anyone know of a way to list all of the users currently logged
in,
| including when someone has su-ed to become another user?
As others have stated, this should be showing up in your /var/log/messages
file. Running a simple:
#cat /var/log/messages | grep su
should do the trick w/out a problem. You could easily set this up as a cron
job that saves to a file, such as :
#cat /var/log/messages | grep su > /homedir/su.txt
--Dave
- Previous message: SB CH: "Re: latest ptrace hole patch?"
- Maybe in reply to: Klotz, Brian: "Seeing who has su-ed"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
