Sudo

[Davis Paul]

Hi,
How can I monitor each and all commands from all users using sudo? Now I can do only sudo commands.
Regards,
Davis Paul.

[Steven E. Protter]

Shalom,

sudo itself limits what normally root only commands the user can execute.

If you do not have root access you can not monitor other users sudo activity.

If you have root access you can monitor the users keyboard logs, usually .sh_history in the users home directory. To be sure see what HISTFILE says in the users .profile file.

SEP

[Dennis Handly]

You need to be a little clearer. Did you mean:
1) ... from all users, using sudo
2) ... from all users that just happen to use sudo

Do you want to monitor ALL commands, whether sudo or not?

[Davis Paul]

Hi,
I have a sudo log file in /var/run/sudo/sudo.log. From here I can get the command which I have given in /opt/iexpress/sudo/etc/sudoers for particular users. In this log file I am getting only command which starting with the word 'sudo'. I want to make an entry for all command evev if they are not starting with 'sudo'. Also how can I make a log entry in var/run/sudo/sudo.log for an ordinary user who has no special privileges in /opt/iexpress/sudo/etc/sudoers ?

[Matti_Kurkela]

You might try "sudosh", a program to extend the logging capabilities of the regular sudo.
http://sourceforge.net/projects/sudosh/
When a user starts a shell as another user using sudosh, it will log all the commands the user enters in that session.

If you need to log _all_ commands, whether using sudo or not, you should examine the auditing capabilities of HP-UX.

Note that the auditing system will, if necessary, log the start of _every process_, whether user-initiated or not. You may need to filter or otherwise post-process your audit logs to keep them in manageable size and/or find the relevant data in them.

MK

[Davis Paul]

closed