Login logging?

juju · 02-12-2008, 06:29 PM

Greetings,

Definitely a newbie question here. I'm running Slackware 12 on a couple of machines, to be used by a group of people. I'm the default sys admin. I'd like to maintain a log of logins, that can't be deleted, even if someone has obtained the super user login info. Is this possible?

Thanks,

JuJu

MS3FGX · 02-12-2008, 08:21 PM

You mean a file that is impossible to delete under any circumstances? As far as I know, that can't be done under a Unix environment (sounds like a Windows "feature").

You could push the file to a remote server/device though, or somehow hide and or encrypt it.

gilead · 02-12-2008, 08:26 PM

The lastlog command should do what you need. However, once root is logged in they can do whatever they want. Perhaps you could have a cron job run the transfers /var/log/lastlog to a remote location every few minutes. The problem there is that whoever gets root access could view that cron job and find the remote log as well.

vwvr9 · 02-13-2008, 03:01 AM

also use PKI only authentication when possible to minimize your risk.

chrism01 · 02-13-2008, 07:00 PM

If they get in as root, your options are limited.
You can scp or ftp to a remote system, but it (the remote sys) will have to prevent that same cxn deleting files.
The old fashioned bullet-proof way is a cheap (remote) printer or other write-only device eg burn to a WORM CD/DVD drive (again remote to prevent physical theft).
Of course, email (to a remote sys) is an option...