Linked Questions
18 questions linked to/from Log all commands run by admins on production servers
5
votes
2
answers
7k
views
How to log all commands run on Linux including their arguments (parameters)? [duplicate]
How can I log all commands executed on Linux, including their command-line arguments (parameters)?
So, for example, if someone runs:
rm -rf /tmp/foo
I would see a log entry similar to this:
2016-01-...
17
votes
4
answers
4k
views
Log every command executed from root
I want to give access to my root server to an external system administrator, but i want to be sure to double check what he is doing to my server, e.g. copying data i don't want them to do and so on. I ...
17
votes
5
answers
809
views
Need a technique to coerce sysadmins to log the reason for accessing a prod server
My company requires that any time a user logs into a production server the reason that person logged in and the changes the user intends to make must be logged. My team wants to do this, but its easy ...
5
votes
2
answers
7k
views
Getting auditd to record the original user
This question is related to my previous question: Log all commands run by admins on production servers
It is company policy for admins to login to the servers via a personal username, and then run ...
3
votes
1
answer
13k
views
How to install auditd on CentOS?
How to install auditd on CentOS 6.4 x64 ?
I want to Log all commands run by admins
Log all commands run by admins on production servers
Edit: I can't run aduditd service
I did with this tut
enter ...
5
votes
2
answers
538
views
Get command history run by third party through ssh
I'm providing access to third party service through ssh, that service install some packages and do other kind of configuration on my server I want to know which commands or scripts are run by that ...
5
votes
1
answer
2k
views
Limit number of concurrent users switching to root account?
This is for Ubuntu 14.04 and Centos 7.
I need to limit the number of users actively running as root. i.e. Logged in as root on the CLI.
Basically, I want only one user at a time to be able to run ...
1
vote
1
answer
2k
views
auditd auid changes after su
I try to implement individual accountability for my RHEL systems using selinux and the audit.log. I followed the instructions given here: Log all commands run by admins on production servers
If I ...
5
votes
0
answers
1k
views
Auditd in a PCI-DSS-compliant Linux cluster
I'm familiar with some of the more common ways of configuring a Linux server to be compliant with PCI-DSS 3.2, at least to the requirements of SAQ A. A common concern is requirement 8.5 which ...
2
votes
0
answers
2k
views
Auditd - log all ssh sessions
We have about a thousand servers / virtual machines, and currently keeping track of who did what where isn't easy. And to make it worse, clients have access to their own machines and often don't know ...
1
vote
1
answer
1k
views
Modify the command line that gets saved to history / .bash_history in Linux
When commands are saved to history in Linux, is there some way to prepend the command line in the history with the remote SSH IP address and process ID so that it's easy to group commands from the ...
1
vote
3
answers
257
views
Log ssh communications
I have a closed source program which calls server over SSH and executes a set of commands.
Could you tell me how can I log all commands?
My server is under Ubuntu.
2
votes
1
answer
247
views
How to log administrator activities in Red Hat Enterprise? [closed]
Is it better to use auditd or sudo logs to log root and other user activities on a Red hat enterprise machine?
1
vote
0
answers
406
views
How to log commands executed by users with non-interactive shells
I want to log commands executed by an application server(resin) to catch things like "cat /etc/passwd" or "whoami" being executed by user resin.
However, since the user resin uses a /bin/false shell, ...
0
votes
0
answers
385
views
How to enable sudo and disbale sudo su on ubuntu 20.04
We need to capture user commands, on logs now the user has Sudo access. we have planned to disable sudo and they need to use sudo before the command. How to enable sudo and disable sudo su on ubuntu ...