[comp.unix.questions] How to catch a snoopy sysadmin?

ian@crowfix.uucp (Ian Smith) (03/31/91)

I am posting this for a friend.  His sysadmin is a bit of a snoop,
and may be reading everyone's email.  Does anyone have advice on
how to catch him?  We were thinking of snooping ourselves (all
users know the root password).  Is there, perhaps, some way to keep
track of all root commands, or to track root terminal i/o?

Any help in snooping on this snoop is greatly appreciated :-).
Either email or posting is fine.  Thanx.

-- 

... _._. ._ ._. . _._. ._. ___ .__ ._. . .__. ._ .. ._.
          Ian Smith, Jr. / uunet!crowfix!ian

john@iastate.edu (Hascall John Paul) (04/01/91)

In article <1991Mar31.011850.432@crowfix.uucp> ian@crowfix.uucp (Ian Smith) writes:
}I am posting this for a friend.  His sysadmin is a bit of a snoop,
}and may be reading everyone's email.  Does anyone have advice on
}how to catch him?

   I think the general technique is to put someting so juicy (but false)
that [s]he will just *have* to comment about it in several email messages
but *never* mention it in any other way (have several people in on this).

John

haynes@felix.ucsc.edu (99700000) (04/01/91)

In article <1991Mar31.011850.432@crowfix.uucp> ian@crowfix.uucp (Ian Smith) writes:
>I am posting this for a friend.  His sysadmin is a bit of a snoop,
>and may be reading everyone's email.  Does anyone have advice on
>how to catch him?  We were thinking of snooping ourselves (all
>users know the root password).  Is there, perhaps, some way to keep
>track of all root commands, or to track root terminal i/o?

Everybody knows the root password and you're worried about one snoopy
administrator?!?!