Linux

Ask something
Discussion Locked

Solaris root logs -single user mode-

0 helpful
2 replies

by mousy

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
How does a Solaris system determine who owns root when somebody uses su to root (to write it to a log file)? What about in user single mode, where does the system gets the information to save it to the logs?

2 replies

by mshavrov

When you use "su" command, you a getting all access privileges from the account you are switching to. There are some differences between "su root" and "su - root". In second case you will have full profile as if you just login as root. In first case you will keep your environment, UserID and GroupID, and just get "root privileges". But in any case, all your attempts to do "su" should be logged to /var/adm/sulog file, so you can track who were trying to become root.

Good luck,

Michael Shavrov
Sun SCSA, MCSE W2K, Security+, CCNP, CCDP

by paulo.sedrez

The owner of the proccess that called su (Real User ID) is written to the log; the Effective User ID becames root.

In single user mode ("boot single", or "init 1") is the same thing, but the initial Real User ID is root (UID=0).

This discussion is closed to new replies.