Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Say you want to be able to easily see who's logged in to a system recently.

auth.log has this information, but it's very cluttered with crontab entries and you have to use sudo to read it.

Proposed solution:

  • Write a script to parse /var/log/auth.log looking for interesting things
  • Make root the owner of that script
  • Create a user who can't login
  • Add that user to the "adm" group, thus giving them read-only access to logfiles
  • Put the script in that user's crontab

What are the security risks of that solution? Adding someone to adm group seems risky, but if all they can do is run a script that's been checked to not do anything bad.

share|improve this question

1 Answer 1

up vote 0 down vote accepted

The solution should not pose a security risk by itself, unless output of the script is sent via mail or saved somewhere readable by other users.

The purpose of the adm-group is to allow users in that group to consult log files and /dev/console, used by eg. xconsole to display console messages.

share|improve this answer
    
What's the risk of making this report visible to other users? We might want them to be able to see that information. –  OJW Feb 22 '13 at 16:05
1  
By "other users", I meant users who should not be able to read this information. Showing the authentication log (or parts thereof) might disclose information about the users or the system in question. –  Cedric Feb 25 '13 at 14:17

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.