SatSig topic:

Remote Access iDirect X3

(Read 5873 times)

Jul 14^th, 2011 at 6:57am

Is it possible for me check that who is telnet/sshing into the iDirect EVO X3 remote and if I can check its history that what changes have been made to that remote (if any). Especially If I wanna check it from someother place other than the HUB!

Jul 14^th, 2011 at 5:53pm

yes its possible but it sure do depend on your provider like for ours it can work using the monitor web based software. (TALIA)

Jul 18^th, 2011 at 8:34am

hm...i agree with that. what i mean here is that can I log onto the remote X3 and check somewhere its history if someone logged on before and if he made any changes!

Jul 20^th, 2011 at 3:13pm

I don't think so. The only changes that you could typically make are to configuration and everything is stored in the options file (etc/idirect/falcon.opt). The actual software is loaded from an image and this couldn't be changed very easily.

Jul 20^th, 2011 at 7:04pm

in the SSH prompt you have a history command, it's a standard linux command, however, I am not sure what the history size is, or even if it's disabled by iDirect as standard. Command:
#history

you will be able to see what commands were issued, for instance if someone opens the options file using VI or CAT you will see this, what changes they made in the file, you will not be able to see from there.

honestly if someone makes changes in the options file, which really is the common place to make changes, it will show on iBuilder, the NMS does a saved vs actual options file check.

for the Telnet, I am not sure, I will have to check what history you can see.

Now as for who has logged in to the system via SSH, I think, again going off the top of my head, you can use the last command:
#last
this should return who has logged in, when they logged in and if they have logged out or are still connected.

hope they work out and give you some detail you are looking for.

BTW all the above will be cleared if the router is rebooted, the history and last commands will return nothing if the remote was reset. (note: you can use #uptime to see how long since the last OS reboot)

Jul 25^th, 2011 at 7:24am

Thanks Scout...for explaining few things so better.

# history
-ash: history: not found

(i think they disabled this command in this image of X3)

# last
last: /var/log/wtmp: No such file or directory
Perhaps this file was removed by the operator to prevent logging last info.

(Can you help me with this command to enable as I see this one almost close to what I'm looking for)

Nov 21^st, 2011 at 12:18pm

Just to update that I've found out that if some user telnet or ssh into EVO X3, it is detected by iMonitor and stores in its logs.

Still curious to know if we can actually find if the logged user (from a remote location) has made any configurational changes!