LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Security (https://www.linuxquestions.org/questions/linux-security-4/)
-   -   Need info on logging who reboots the server (https://www.linuxquestions.org/questions/linux-security-4/need-info-on-logging-who-reboots-the-server-825350/)

warduke 08-10-2010 10:30 AM
Need info on logging who reboots the server
 
Someone has been logging in and issuing reboot commands. I am Running Redhat EL 5. Is it possible to find a log or start logging from which IP the reboot command came from or which user?

sem007 08-10-2010 10:46 AM
you can user last command.
Code:
root    pts/2        10.0.7.232      Wed Aug 11 02:43  still logged in
root    pts/1        :0.0            Wed Aug 11 02:39  still logged in
root    :0                            Wed Aug 11 02:39  still logged in
reboot  system boot  2.6.18-53.el5    Wed Aug 11 02:38          (00:05)
shailesh pts/1        10.0.7.234      Wed Aug 11 02:36 - down  (00:00)
root    tty1                          Wed Aug 11 02:32 - down  (00:04)
root    pts/1        :0.0            Wed Aug 11 02:20 - 02:32  (00:11)
HTH

warduke 08-10-2010 10:58 AM
Thanks I tried that but here is what I get. Im not sure why it shows this way..It doesnt say who issued the reboot command unless I am missing something

root pts/1 1x.1x.4.x Tue Aug 10 00:17 - 04:18 (04:01)
root pts/1 1x.1x.4.x Tue Aug 10 00:09 - 00:10 (00:00)
root pts/1 1x.1x.4.x Tue Aug 10 00:00 - 00:02 (00:01)
root pts/1 1x.1x.4.x Mon Aug 9 23:55 - 23:58 (00:03)
root pts/1 1x.1x.4.x Mon Aug 9 23:52 - 23:54 (00:02)
root pts/0 1x.1x.4.x Mon Aug 9 23:49 - 00:22 (00:32)
reboot system boot 2.6.18-92.el5 Mon Aug 9 23:48 (11:59)
wxxx pts/4 1x.1x.4.x Mon Aug 9 15:39 - 15:43 (00:03)

valen_tino 08-10-2010 01:56 PM
Only super users (such as root) have privileges to reboot a system. The "last" command will only tell you when the command was issued by the pseudo user "reboot".
The only way to tell is to go through the ~/.bash_history of each user and check for any su or sudo commands to root with subsequent attempts to reboot.
This logic will obviously not apply if you are sharing the root password with anybody else. Also check for any cron jobs that are set up.
To sum it up, enforce the use of sudo.

Matir 08-10-2010 04:05 PM
Moved: This thread is more suitable in Linux - Security and has been moved accordingly to help your thread/question get the exposure it deserves.


All times are GMT -5. The time now is 10:43 AM.