topic Re: SUDO rights in Operating System - Linux

SUDO rights

praveen.. — Wed, 24 Jan 2007 02:05:28 GMT

Hi,
I need to give root preveliages to one user "db2root".

How to enable sudo for this user in RHEL.

Please suggest

thanks

Re: SUDO rights

Alexander Chuzhoy — Wed, 24 Jan 2007 02:26:14 GMT

as root run visudo.
The add a line to the end of the file:
db2root ALL=(ALL) ALL

save and close.
Not db2root can execute any command by running:
sudo
By default he'll be prompted for his password, which can also be eliminated.

Re: SUDO rights

Vitaly Karasik_1 — Wed, 24 Jan 2007 02:26:19 GMT

first at all, you should decide which command[s] this user should be able to run as root.

and for configuring sudo itself - see http://www.onlamp.com/lpt/a/2680

Re: SUDO rights

praveen.. — Wed, 24 Jan 2007 04:19:30 GMT

Thanks

can you please let me know

from which file i can get the list of command which db2root user runs using sudo

it is not showing in /var/log/sudo.log & /var/log/messages

Thanks

Re: SUDO rights

Vitaly Karasik_1 — Wed, 24 Jan 2007 04:26:00 GMT

IIRC, it should be under /var/log/messages or /var/log/security

Re: SUDO rights

Alexander Chuzhoy — Wed, 24 Jan 2007 04:41:55 GMT

Executed command are listed in /var/log/secure.
You can also configure the sudo the send you an e-mail for each sudo execution.

Re: SUDO rights

praveen.. — Wed, 24 Jan 2007 05:01:54 GMT

hi,
thank you very much. can you please let me know how to configure the sudo the send me an e-mail for each sudo execution.

This will be very helpful for me for monitoring purpose

Thanks

Re: SUDO rights

Alexander Chuzhoy — Wed, 24 Jan 2007 05:44:16 GMT

Add the following line to /etc/sudoers (run visudo to edit):
Defaults:ALL mailto="email_address@domain",mail_always

Re: SUDO rights

praveen.. — Wed, 24 Jan 2007 08:19:16 GMT

Hi Alex,
This entry is sending me the email after each command

is it possible that can i get the list of command which were run in last 24 hours in 1 mail.

Thanks

Re: SUDO rights

Alexander Chuzhoy — Wed, 24 Jan 2007 09:15:58 GMT

you can create a crontab entry that will run on a daily basis and send you an e-mail with the output of `grep sudo /var/log/secure`.

Re: SUDO rights

praveen.. — Wed, 24 Jan 2007 10:43:05 GMT

Hi Alex,

But the output of `grep sudo /var/log/secure` will be all days,

I want just for the last 24 hours on daily basis.

Thanks

Re: SUDO rights

Alexander Chuzhoy — Wed, 24 Jan 2007 13:07:27 GMT

AFAIK,all entries in log file include dates.
So the script, which will be executed at 00:00 for example, based on current date, should calculate the previous date and send you the output of :
`cat /var/log/secure|grep sudo |grep $previous_date`.

If no one will provide you with such script example-I'll try post it as soon as I'll get to Linux machine...

Re: SUDO rights

Ivan Ferreira — Wed, 24 Jan 2007 14:00:45 GMT

You can also force logrotate to rotate daily the /var/log/secure file.