Monitoring Root Account on Linux Server

[10061987]

Hi all,

I have a case about monitoring Linux servers. Here what i am trying to do. I am not sure this is possible or not but i have to do these things with possibilities because System Staff wanted these from me.

1-Root SSH access enabled servers --> Need Help

2-When someone changed sudoers file --> Done.

3-Root password change --> Done.

4-Users who have "0" ID except root --> Need Help

I did some steps but i need help about 2 step. Any help would be appreciated!

[isoutamo]

Hi
what you already have in those servers?
- UF
- some Unix/Linux TAs
- what kind of data it is collection
- what logs it's collecting
- how and in which user your UF is running (shouldn't run as root).
r. Ismo