LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Software
User Name
Password
Linux - Software This forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.

Notices


Reply
  Search this Thread
Old 07-20-2012, 03:06 PM   #1
daisychick
Member
 
Registered: Nov 2006
Location: Texas
Distribution: ubuntu 12.04 LTS
Posts: 154

Rep: Reputation: 0
user auditing


So, I have some users that are saying their data is "disappearing." I'm looking for an auditing software that would show in depth reports of all commands input by users and all files touched. Can anyone make a recommendation?

Ubuntu 12.04 LTS
 
Old 07-20-2012, 03:32 PM   #2
Kustom42
Senior Member
 
Registered: Mar 2012
Distribution: Red Hat
Posts: 1,604

Rep: Reputation: 415Reputation: 415Reputation: 415Reputation: 415Reputation: 415
Not sure of any user auditing software but I would bet my bottom dollar that this is a pebkac error with the users. You should be able to review the individual .bash_history files for the users to do a manual audit.
 
Old 07-20-2012, 04:06 PM   #3
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600
Quote:
Originally Posted by daisychick View Post
I'm looking for an auditing software that would show in depth reports of all commands input by users and all files touched. Can anyone make a recommendation?
Sure can:
0) The auditd service allows you to create rules to selectively log anything done by users via system call usage (not invasive if your kernel supports audit),
1) loggedfs (see example outout in the auditd missing syscalls? thread) allows you to selectively log anything done by users using FUSE (depends on FUSE),
2) Inotify allows you to watch syscall usage somewhat similar to audit,
3) There's a few Bash logging patches around (invasive: have to replace users shell with patched version),
4) Rootsh allows you to log complete users shell history including key strokes and file contents (invasive: have to replace users shell with rootsh),
//*) For completeness sake long-forgotten tool eliott watched directories for files creation/deletion/writes using dnotify (but that was old school kernel 2.4 stuff).
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Auditing apache user Dr_Death_UAE *BSD 0 02-14-2010 02:23 AM
I need an Auditing solution - Please Help AmdMhz Linux - Newbie 6 11-20-2008 12:52 PM
network auditing cynthia_thomas Linux - Networking 2 10-13-2006 06:07 AM
Auditing Services dollaz Linux - General 1 02-17-2005 03:31 PM
user auditing tools cyph3r7 Linux - Security 9 12-24-2003 09:26 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Software

All times are GMT -5. The time now is 03:52 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration