Originally posted by: SystemAdmin

i need to get some evidence for a activity been done by one of my staff .
he have deleted some application files and have clear all the proof of
his activity , .sh and wtmp files cleated.

any other method that i can use to get the evidences of his activity.
time,laptop ip and command that he run?
#AIX-Forum

Originally posted by: flodstrom

I assume that the suspect person have (had?) root access to the system, correct? If that is the case and he/she knew how to cover their tracks than there's probably not much you can do.

Have you checked the system logs (login times, etc.)? Have you checked the sulog?

Unless you have prepared the system for events like these (like setting up system logging and sending the system/auth logs to secured remote hosts, etc.) it might already be to late to find out what happened.
#AIX-Forum

Originally posted by: SystemAdmin

It sounds as though you should block all direct access to the root login; and force those staff, who require root access, to do so via the sudo command. You can also setup sudo so that Support staff can run some commands as root; without actually gaining full root privileges.

Also, you may consider forcing all Support staff to use ssh for connections. Both the use of sudo and ssh will result in your support staff logins being logged to the syslog as well as wtmp. You should also change sshd.conf to prevent direct root login.

An additional thought would be to ensure that extended history is configured in /etc/profile. That way all actions are timestamped in the user $HOME/.sh_history file. We have added code to the /etc/profile to place a login timestamp to the $HOME/.sh_history. A guilty user then has to go around deleting other user .sh_history files; or look extremely suspicious.

The file deletion could have occurred via many pathways; e.g. ftp, sftp, rsh. You should consider which of these services can be removed from inetd.conf in order to assist in securing the system.

Sorry if this answer rambles a bit.
#AIX-Forum