Re: [logs] adduser log

Previous message: Bennett Todd: "Re: [logs] adduser log"
In reply to: Pinel Pierre-Marc: "[logs] adduser log"
Next in thread: Paul D. Robertson: "Re: [logs] adduser log"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

mikael.olssonat_private

Pinel Pierre-Marc wrote:
> 
> I need to log the use of the adduser comand on a Red
> Hat server.
> 
> Is there any other solution than to modify comand and
> doing a script than logs an event.
> 
> Thanks for cooperation

A better solution may perhaps be to periodically do a 
diff of /etc/passwd, to catch _all_ forms of user account
manipulation?

If mailing the changes will do, this ought to work:
---8<--- cut ---8<--- 
#!/bin/sh

umask 077

if diff /etc/passwd.prv /etc/passwd > /dev/null 2>&1; then
  exit 0
fi

diff /etc/passwd.prv /etc/passwd 2>&1 | 
  mail -s "/etc/passwd changed" root

cp /etc/passwd /etc/passwd.prv

---8<--- cut ---8<--- 

-- 
Mikael Olsson, Clavister AB
Storgatan 12, Box 393, SE-891 28 ÖRNSKÖLDSVIK, Sweden
Phone: +46 (0)660 29 92 00   Mobile: +46 (0)70 26 222 05
Fax: +46 (0)660 122 50       WWW: http://www.clavister.com
_______________________________________________
LogAnalysis mailing list
LogAnalysisat_private
http://lists.shmoo.com/mailman/listinfo/loganalysis