IDing originating user?

From: dkoleary@attbi.com
Date: 11/13/02 

From: dkoleary@attbi.com
Date: Wed, 13 Nov 2002 17:16:34 GMT

Hey;

I recently implemented f-secure on about 50 HP servers and everything's
working great. There's one last little bit of functionality that I'd
like to implement from our old environment.

Here's what we used to have:

* Telnet access allowed for everyone except root - had to su or sudo into
  root.
* Root's profile would set the command line history file based on the
  originating user name - ~root/.sh_history.dkoleary, for instance.

With the new ssh environment, I'm allowing the admins to get directly
into root with public key authentication. The issue is that everyone
is now sharing the same history file.

I have figured out two potential work arounds:

* Creating a script and using a command keyword to call it
  in the ~/.ssh2/authorization file. The script will ID the
  user and set the history file appropriately.
* Obtaining the pid from the SSH2_AUTH_SOCK, id'ing public key
  from the syslog used for that pid, then setting the history file
  from that.

Both of these methods are about as ugly as sin. Is there a clean
way of identifying the originating public key and/or originating
user?

Any help would be greatly appreciated.

Doug O'Leary

--------
Senior UNIX Admin
Independent consultant
dkoleary@attbi.com
resume: http://home.attbi.com/~dkoleary/resume.html

Relevant Pages

  • RE: Linux hacked
    ... Also, what exactly did the history file show, can you paste it into a mail ... > First let me say I'm a security novice. ... > been unsuccessful in getting root back. ... > via ssh but you could su in once logged in as one of three users. ...
    (Security-Basics)
  • Re: how to look at anothers history ?
    ... way by which I can see his history file? ... However, if he logs in as root, as so has the default shell for root, I doubt you can see what he has typed. ... PS, I'm not a regular AIX user, so AIX might have its own ways. ... 'Experts Exchange' take questions posted on the web and try to find ...
    (comp.unix.aix)
  • Re: IDing originating user?
    ... > * Telnet access allowed for everyone except root - had to su or sudo into ... > is now sharing the same history file. ... The script will ID the ... > way of identifying the originating public key and/or originating ...
    (comp.security.ssh)
  • Re: bash on AIX 5.2
    ... >>I'm not using root. ... I actually changed the default login shell for my ... Check if there is a .history file in your ... If not, use the RPM. ...
    (comp.unix.aix)
Loading