Always Keep logs, disable root telnet

/var/adm directory

messages, syslog, wtmp, sulog

/etc/login.defs for Linux Shadow Password

Disable root telnet, increase "login incorrect" delay time

Only staff can use "su"

> ls -al /bin/su
-rws--x--x   1 root     staff        24576 Jul 25  1995 /bin/su

Put last command in users profile script

echo "w ; /bin/last ott | head -10" >> .cshrc"