topic Sudo in Operating System - HP-UX

Sudo

Davis Paul — Thu, 17 Apr 2008 04:31:45 GMT

Hi,
How can I monitor each and all commands from all users using sudo? Now I can do only sudo commands.
Regards,
Davis Paul.

Re: Sudo

Steven E. Protter — Thu, 17 Apr 2008 04:48:28 GMT

Shalom,

sudo itself limits what normally root only commands the user can execute.

If you do not have root access you can not monitor other users sudo activity.

If you have root access you can monitor the users keyboard logs, usually .sh_history in the users home directory. To be sure see what HISTFILE says in the users .profile file.

SEP

Re: Sudo

Dennis Handly — Thu, 17 Apr 2008 04:49:18 GMT

You need to be a little clearer. Did you mean:
1) ... from all users, using sudo
2) ... from all users that just happen to use sudo

Do you want to monitor ALL commands, whether sudo or not?

Re: Sudo

Davis Paul — Thu, 17 Apr 2008 05:25:55 GMT

Hi,
I have a sudo log file in /var/run/sudo/sudo.log. From here I can get the command which I have given in /opt/iexpress/sudo/etc/sudoers for particular users. In this log file I am getting only command which starting with the word 'sudo'. I want to make an entry for all command evev if they are not starting with 'sudo'. Also how can I make a log entry in var/run/sudo/sudo.log for an ordinary user who has no special privileges in /opt/iexpress/sudo/etc/sudoers ?

Re: Sudo

Matti_Kurkela — Thu, 17 Apr 2008 05:37:08 GMT

You might try "sudosh", a program to extend the logging capabilities of the regular sudo.
http://sourceforge.net/projects/sudosh/
When a user starts a shell as another user using sudosh, it will log all the commands the user enters in that session.

If you need to log _all_ commands, whether using sudo or not, you should examine the auditing capabilities of HP-UX.

Note that the auditing system will, if necessary, log the start of _every process_, whether user-initiated or not. You may need to filter or otherwise post-process your audit logs to keep them in manageable size and/or find the relevant data in them.

MK

Re: Sudo

Davis Paul — Sun, 03 Aug 2008 08:09:04 GMT

closed