Hi

I want to get a of log all the commands executed by the root user with the following details :

incoming ip
username (thru which su was executed)
time and date
all the commands executed as mentioned above.

Also if user has managed to login as root, he should not be able to disable / delete the above info. Can this info be collected at some other physical server ?

You're looking for something like SELinux (Security Enhanced Linux) developed by the NSA. It's where people can change their user ID (such as su into root) but still remain identified as the same user through their security ID. or something like that.

I don't have much experience with SELinux but I know it can do what you want if you choose to learn more.

http://www.nsa.gov/research/selinux/

A lot of distros provide binary packages for SEL so check your local distro repositories.

Why and what have you tried wrt log correlation already?


'last'?


PAM -> syslog?


Syslog default timestamp?


Psacct (commands only, no details), shell history (weak "evidence") Rootsh (timstamp, commands, output), Auditd (detailed: see the se.* reporting tools) or FUSE LoggedFS (detailed as well, see this for an example).


Unless you run a SELinux "true" MLS policy or other DAC prevention root can modify everything so while you can still use remote syslog, with root being omnipotent the question becomes "will the logs actually arrive there, how do I notice and how do I respond if they don't?".

If you're really serious about tracking who has done what across many *nix boxes I'd suggest you have a look at a product called Privileged User Manager (PUM) from Novell.

http://www.novell.com/products/privilegedusermanager/

You can download it from download.novell.com

What's the measure? How "serious" does one need to be?


Because you're familiar with the product, right? I mean you've deployed the manager and agents, designed rules and so on?
BTW, is it better than any other Privileged Account/Identity/User Management suites?


Can you? I though you could only D/L the evaluation but have to buy the product.

Good corporate governance and your needs to be compliant with regulations such as Sarbanes/Oxley and Basel II, HSPD-12 (government), FFIEC banking), HIPAA (healthcare), FERPA (education).

I'm not going to implement a solution like PUM to track who is doing what on a handful of boxes. For an enterprise solution whereby many boxes need to be audited it is an effective solution to your auditing needs.

That can be quantified based on compliance and ease of use.

Yeah it is an evaluation download which is valid for 60 days.