0

acct logs execution of all processes, and the users that execute them, recording statistics such as real time elapsed, and CPU time elapsed. I have seen it suggested that this might be useful in a forensic context, i.e. working out who executed what, and when. But as it just records the name of the process, I'm wondering what value it really adds.

If I execute

$ cp /usr/bin/cc vi
$ ./vi malware.c -o ls
$ ./ls

then the process accounting log will only contain entries named "cp", "vi", and "ls" - all innocuous.

Therefore process accounting appearas to offer limited security benefits. Any contrary opinions?

1 Answer 1

1

By themselves, these logs are not hugely useful as a security tool, but once you've established that you've been compromised, you can check the accounting logs to see what commands the attacker used, and possibly guage the extent of the damage. It may also shed light on the attacker's techniques, allowing you to try to protect yourself from similar attacks in the future.

It all comes down to practising security in layers - process accounting doesn't stop someone breaking in, but it can provide useful information in determing what happened in the event someone does break in, and can be a useful addition to your security toolkit.

2
  • But you can't necessarily see what commands the attacker used - as process name can be manipulated. The only scenario I can see where process accounting would assist is with a bumbling, naive attacker. Sure, every little helps (security in layers, as you say), but I was hoping for more.
    – jl6
    Mar 9, 2011 at 17:56
  • Yes, you're right - but tracking down a clever, committed attacker is always going to be harder than catching an opportunistic script kiddie. I for one tend to agree with you, and don't use PA, because the space requirements outweigh, for me, any potential benefit in analysing a break-in after the event, and I don't have to keep track of system resource usage for purposes of charging for them.
    – D_Bye
    Mar 9, 2011 at 18:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .