Essential SNMP, 2nd Edition

Who's Logging into My Machine? (I-Am-In)

When Unix users log in, the system automatically executes a profile; for users of the Bourne, Korn, or bash shells, the systemwide profile is named /etc/profile. There's a similar file for users of csh and tcsh (/etc/login). We can use SNMP to record logins by adding a trap to these profiles. By itself this isn't all that interesting, because Unix already keeps a log of user logins. But let's say that you're monitoring a few dozen machines and don't want to check each machine's log. Adding a trap to the systemwide profile lets you monitor logins to all your systems from one place. It also makes your logging more secure. It's not too difficult for an intelligent user to delete the wtmp file that stores Unix login records. Using SNMP to do the logging stores the information on another host, over which you should have better control.^[*]

To generate the trap, invoke the external program /opt/local/mib_ programs/os/iamin in /etc/profile (you can call the same program within /etc/login). Here is the code for iamin:

 #!/usr/local/bin/perl # # Filename: /opt/local/mib_programs/os/iamin chomp ($WHO = '/bin/who am i \| awk \{\'print \$1\'\}'); exit 123 unless ($WHO ne ''); chomp ($WHOAMI = '/usr/ucb/whoami'); chomp ($TTY = '/bin/tty'); chomp ($FROM = '/bin/last \-1 $WHO \| /bin/awk \{\'print \$3\'\}'); if ($FROM =~ /Sun|Mon|Tue|Wed|Thu|Fri|Sat/) { $FROM = "N/A"; } # DEBUG BELOW # print "WHO :$WHO:\n"; print "WHOAMI :$WHOAMI:\n"; print "FROM :$FROM:\n"; ...