topic Re: Sudo Log in Operating System - Linux

Sudo Log

Waqar Razi — Tue, 04 Aug 2009 16:11:37 GMT

I need a suggestion. We are enabling sudo access to our servers. Does sudo offers any type of logging? How can we enable that in RHEL?

I have another question. Lets say we have granted some users root access using sudo like sudo su -. Is there any way, we can monitor that user activity after he has switched to root using sudo su -

Re: Sudo Log

Steven E. Protter — Tue, 04 Aug 2009 16:22:02 GMT

Shalom,

http://linux.about.com/od/commands/l/blcmdl8_sudo.htm

By default sudo logs to /var/log/messages or whatever syslog is set to.

It can be configured to use its own log file.

SEP

Re: Sudo Log

Waqar Razi — Tue, 04 Aug 2009 16:23:40 GMT

Do you know how can we setup it in /etc/sudoers file?

Re: Sudo Log

Waqar Razi — Tue, 04 Aug 2009 16:57:05 GMT

I have setup /var/log/sudo.log for logging sudo activities. I have the following questions now:

1- After switching to sudo root access by using sudo su -, I can see the switch in the /var/log/sudo.log file:

Aug 4 13:49:40 : t-aabb : TTY=pts/1 ; PWD=/home/t-aabb ; USER=root ;
COMMAND=/bin/su -

But after that, sudo.log is not logging any activities performed by user imran as root. For instance, lets say the user now issues shutdown -r now command after switching to root using sudo su -, How can I configure sudo to log these activities as well.

Re: Sudo Log

Jeff_Traigle — Tue, 04 Aug 2009 18:20:37 GMT

You can't. Sudo will only log the command it allows. If "su -" is allowed, sudo won't know anything about it and won't log it. Some system command auditing is needed... preferably one that has a facility to log remotely to a system the user doesn't have the ability to potential access and modify log records. Relying on shell histories and local logs, especially when allowing a root shell, isn't very effective. :)

Re: Sudo Log

Jeff_Traigle — Tue, 04 Aug 2009 18:21:56 GMT

That should read:

If "su -" is allowed, sudo won't know anything beyond that and won't log the shell activity.