Can sudo be set to log entries in 2 different places (locally and externally)

[Dario_1]

Hi everyone!

Currently have SUDO set to write all the log entries to syslog. (which is the default and we will like to keep)

Recently, we hired a third party company to check our logs (we are supplying them with the syslog information using the syslog.conf file)but we will like to also provide them with the SUDO activity entries.

Would it be possible to push the SUDO entries to the log server and also keep an entry in the syslog file?

I know that you set that in the sudoers file but will like to make sure the syslog entry will still be available in syslog.

Thank you for your help.

DR

[Geoff Wild]

Yes - you have to pipe it with the logger command.

I have a security system whereby I rotate the log every day at 23:55


FACILITY=local1.info
TAG=BOKS
tail -f /var/opt/boksm/data/LOG | /opt/boksm/sbin/bkslog -f - | logger -p $FACILITY -t $TAG &

You should be able to do the same with sudo.

Rgds...Geoff

[Ivan Ferreira]

SUDO can be configured to use syslog, and syslog to log into a remote host. So you can have two logging locations.

[Ivan Krastev]

using visudo add this lines:

Defaults !syslog
Defaults logfile=/var/adm/sudo.log


this will log entries in another file. For more info see man sudoers.


regards,
ivan

[Dario_1]

Thank you all for the answers.

Geoff:

I was thinking about doing something like that but I have to push the SUDO entries immediately to the company's appliance because we are getting real time response from them.

Ivan:

Your solution is the most appropriate but I can't come up with the correct syntax to direct and load the SUDO information to the appliance. Currently, I have the following line which is working fine but this is only uploading system generated messages.

*.emerg;*.err;*.alert;kern.debug;daemon.notice;auth.info;cron.info;mail.crit @COMPANY.IP.ADDRESS

All the SUDO entries have the word bmoc on them which should make this process easier but I am not able to get any information loadded to the company applicance.

Ivan:

My original question was generated thinking on that Default option but if I do that, I will stop sending entries to the syslog and will just create a separate log.

My question in this case will be:

Can I direct log entries to an external appliance? If yes, do I have to disable syslog or can I have both enabled?

[Geoff Wild]

With my way - they do go immediately - bacically, as the log changes (tail -f) it is sent to the remote server.

The reason for the 23:55 - is the log is quite big - so I rotate it.

Rgds...Geoff

[Dario_1]

Geoff:

One more question, are you pushing the entries with the logger command to a local or external file? I am trying to push these files to a centralized logging server which is external. I don't know if the -f option will allow me to do that.

Thank you.

[PeterWolfe · Accepted solution]

Dario,

>One more question, are you pushing the entries
>with the logger command to a local or external file?

Geof's suggestion is that if you have sudo log to its
own log file, then you can also have those log entries
forwarded via syslog by injecting those log
entries into syslog. His tail -f script was monitoring
the log file and using logger to post the log entries
to syslog. If your syslog is configured for syslog fowarding,
then the end result is that the sudo log messages end up
in the sudo log, the local syslog, and the remote syslog.

That said, since sudo can already log to syslog directly,
I think the only piece you are missing is that your
syslog.conf forwarding entry needs work:

*.emerg;*.err;*.alert;kern.debug;daemon.notice;auth.info;cron.info;mail.crit
@COMPANY.IP.ADDRESS

From the sudo docs, it looks like sudo defaults to using
the "local2" facility (and this is customizable).
But it's not clear what priority message are used. For example,
the docs mention syslog_goodpri (defaults to notice)
and syslog_badpri (defaults to alert). Are there others?
Your current syslog filter would be missing local2.notice but
catching local2.alert. alerts would be posted when a user
authenticates incorrectly to sudo. If you leave the sudo
facility at local2, then add local2.* to your syslog filter and
all sudo messages will be forwarded.

[Dario_1]

Peter

Thank you for the clarification. That is totally true. The 3rd party company notified that they are getting some of the SUDO, which happens to be the alerts because I have the *.alert in the line. In order to be able to forward the rest, I will add the *.notice to the line and I will get the rest.

Now, the IDS alerts I will try to get by assigning the priority to local5.alert using the logger command with the -p option and then adding the local5.alert to the syslog.conf line. That should take care of that.

Thank you all for all the help.

DR

[Bill Hassell]

If you use the standard HP-supplied sudo, the syslog facilty is LOCAL2 with the priority NOTICE for successful sudo invocations and ALERT for failed sudo commands. Like most applications, this information is never documented so you have to discover it by restarting syslogd with the -v option. Since this is really useful, I make the change permanent in /etc/rc.config.d/syslogd. The attached script can decode the special 2-char code that syslogd -v adds to syslog.

Note that /etc/syslog.conf REQUIRES tabs for each entry and silently ignores lines with spaces. Use cat -t /etc/syslog.conf to show the tabs (and spaces).

[Dario_1]

Bill:

You got it. I was able to re-direct IDS data as well by using your recommendation.

thank you,

Dario