Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Consider a couple of engineers toying with a remote machine via ssh. Everyone has a root access, which is bad, I know, but that's how it is. Thankfully, the machine is physicaly on the testing grounds and everybody is lazy to go there each time. So basically it's like this:

  1. One logs in via ssh, obtaining session number (from 1 to a lot) and leaving own IP in an USER_START message.
  2. Does something as root, leaving own session number in every audit message.
  3. Logs out; or reboots the machine, so the session numbers would start again with 1 from this moment.

Basically, to track someones' IP you have to consider not only his session number, but login time as well. That might be cumbersome with multiple reboots, so naturally I have a feeling of doing something wrong.

Is there a proper way to determine ssh logged roots' original IP for every given auditd message?

share|improve this question
add comment

Know someone who can answer? Share a link to this question via email, Google+, Twitter, or Facebook.

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.