Hi,
I am trying to write a script which would figure out who has run which command and their IP. As i dont have any clue as to which commands would do this job, i request some gurus to help me on this.
Thanks
Vishwas
Do you mean shell commands? The last command can show you when a user logged in and from where. There is no standard facility for recording individual commands, although some audit systems for doing this exist. What to recommend depends somewhat on which platform you are on. If I recall correctly even The GNU Accounting Utilities offer the basic tools for this.
Like era said, accouting will do the job, but it will only give you the commands executed by a given user, not the IP address he/she used to enter your machine.
For something really accurate you could use grsecurity's patches which specially create a proc entry with the ip address of the user who created a given process.
Not sure if selinux would help you with this.
RSBAC also gives you IP information in its logs.