Date: Sat, 5 Jun 2004 12:46:26 -0700 (PDT) From: Viktor Lazlo <viktorlazlo@telus.net> To: jimmie james <h2g2_jimmiejaz@yahoo.com> Cc: questions@freebsd.org Subject: Re: Monthly security run. Message-ID: <20040605124225.F36793@byx0rm.mr-clevver.com> In-Reply-To: <20040601155631.39094.qmail@web13426.mail.yahoo.com> References: <20040601155631.39094.qmail@web13426.mail.yahoo.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Tue, 1 Jun 2004, jimmie james wrote: > Doing login accounting: > total 1438.65 > jimmie 1435.18 > root 3.46 > > This all makes perfect sense, though I was wondering, > if there's an easy way to get the script to log how > many times (and optionally, who) uses "su" or "su -" > and to what account they jumped to. > > Unfortunaly, I'm not a code monkey, so digging around > in the source, and trying myself would probably break > something. You can do this easily enough by polling /var/log/messages for any use of su: grep -i su /var/log/messages | sort +6 Set this up as a daily crontab item and the results will be emailed to you automatically. Cheers, Viktor
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20040605124225.F36793>