Re: root shell auditing

Hari Sekhon wrote:
Diego Lacerda wrote:
Hi, Mars,

I think that you could use Linux Process Accounting to audit
everything that you need in a shell environment.
I've tried this, it lacks some detail if I remember correctly it doesn't log params as it was designed for process accounting, not security auditing, which could mean missing a lot as sometimes it's the parameters that make all the difference between a normal and a dangerous action.

So far for me, snoopy comes closest.

-h

The Kernel accounting/audit might actually be the only real thing here though.

I'm currently in need of a thourough accouting/auditing setup myself and I haven't managed to find anything that does the job as needed (e.g. secure)

Snoopy hasn't been maintained for a long time and segfaults on x86_64, "linuxbsm" (an attempt to create a Linux Basic Security Module) hasn't been maintained since 2001 either and bash patches just won't suffice.

So if anyone knows of any other reasonably secure and practicable way to do these things, recommend it. My guess is kernel accounting/audit is the way to go however.

Relevant Pages

  • Re: root shell auditing
    ... I think that you could use Linux Process Accounting to audit ... I've tried this, it lacks some detail if I remember correctly it doesn't log params as it was designed for process accounting, not security auditing, which could mean missing a lot as sometimes it's the parameters that make all the difference between a normal and a dangerous action. ... This way all root commands would either be logged or you'd be alerted to someone intentionally circumventing the logging by getting a full root shell. ...
    (Focus-Linux)
  • Re: root shell auditing
    ... I think that you could use Linux Process Accounting to audit ... everything that you need in a shell environment. ... I've tried this, it lacks some detail if I remember correctly it doesn't log params as it was designed for process accounting, not security auditing, which could mean missing a lot as sometimes it's the parameters that make all the difference between a normal and a dangerous action. ...
    (Focus-Linux)