Monthly security run.

[Viktor Lazlo]

On Tue, 1 Jun 2004, jimmie james wrote:

> Doing login accounting:
> total 1438.65
> jimmie 1435.18
> root 3.46
>
> This all makes perfect sense, though I was wondering,
> if there's an easy way to get the script to log how
> many times (and optionally, who) uses "su" or "su -"
> and to what account they jumped to.
>
> Unfortunaly, I'm not a code monkey, so digging around
> in the source, and trying myself would probably break
> something.

You can do this easily enough by polling /var/log/messages for any use of
su:

	grep -i su /var/log/messages | sort +6

Set this up as a daily crontab item and the results will be emailed to you
automatically.

Cheers,

Viktor