Secure OS Software for Linux
cancel
Showing results for 
Search instead for 
Did you mean: 

rootsh and sudo problem

Joppe
Occasional Advisor

rootsh and sudo problem

Hallo all,

I hope someone can help me with this problem.

To make our servers more secure have stopped root access with su and the administartors have to SUDO to run root commands, that is working really well. I have also a logging-program called rootsh to log everything that are done as root, my problem is that to start the logging the admins then they have to "sudo rootsh" and they get a root shell with logging, but it is still possible to "sudo bash" and then they get a root-shell without logging.

What I want is when they use "sudo bash", then the rootsh should be started automaticaly and logg what is happening.

I have not manage to come up with a solution how to get this to work!

Greatful for help!

Cheers
Joppe
5 REPLIES
Muthukumar_5
Honored Contributor

Re: rootsh and sudo problem

You can audit the sudo related commands with history files itself generally.

Another method as writing shell wrapper as,

# mv sudo.org
# cat > sudo
#!/bin/bash
if [[ $1 = "bash" ]]
then
# put the command to start
fi
echo $* | bash

# end
exit 0

###########

Change permission to new sudo file and try now.

--
Muthu


Easy to suggest when don't know about the problem!
Joppe
Occasional Advisor

Re: rootsh and sudo problem

Thanks, that works fine!
But This means that I can't add new users to the sudoers file that I only want to let run a few specified commands.

The question is if it is possible to have it so I still easy can add sudo rules for other users also?

/Joppe
Joppe
Occasional Advisor

Re: rootsh and sudo problem

Oups, was a little to fast to replay.

With this script instead of the orginal sudo makes my logg file look like rubbish instead!

/Joppe
Joppe
Occasional Advisor

Re: rootsh and sudo problem

Okay all I found a solution for my probblem that's working!

I simply changed the default shell for the admin user to my rootsh, and added rootsh in the /etc/shells. And then I have logging from the first second a admin user loggs in to the server until he loggs out!

Cheers

Joppe

Steven E. Protter
Exalted Contributor

Re: rootsh and sudo problem

Shalome Joppe,

If sudo bash works you have no security at all and there is almost no reason to use sudo.

The binaries that can be sudo must be limited by the sudoers file to make this setup effective.

Leaving bash available for sudo is a huge back door that needs to be shut.

As far a logging commands, you can set the HISTFILE variable and all commands input by keyboard logged. This can be in the home directores of your various admins or a central location.

SEP
Steven E Protter
Owner of ISN Corporation
http://isnamerica.com
http://hpuxconsulting.com
Sponsor: http://hpux.ws
Twitter: http://twitter.com/hpuxlinux
Founder http://newdatacloud.com