- Community Home
- >
- Servers and Operating Systems
- >
- Operating Systems
- >
- Operating System - Linux
- >
- sudo -s Logging
Categories
Company
Local Language
Forums
Discussions
Forums
- Data Protection and Retention
- Entry Storage Systems
- Legacy
- Midrange and Enterprise Storage
- Storage Networking
- HPE Nimble Storage
Discussions
Discussions
Discussions
Discussions
Forums
Forums
Discussions
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
- BladeSystem Infrastructure and Application Solutions
- Appliance Servers
- Alpha Servers
- BackOffice Products
- Internet Products
- HPE 9000 and HPE e3000 Servers
- Networking
- Netservers
- Secure OS Software for Linux
- Server Management (Insight Manager 7)
- Windows Server 2003
- Operating System - Tru64 Unix
- ProLiant Deployment and Provisioning
- Linux-Based Community / Regional
- Microsoft System Center Integration
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Community
Resources
Forums
Blogs
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Printer Friendly Page
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО11-24-2010 02:37 AM
тАО11-24-2010 02:37 AM
sudo -s Logging
I have setup winscp to sudo -s for a user.
I have setup the logging to send to the /var/log/sudo.log
the only entry i see in there is the sudo -s.
there after i do not see what the user is doing.
I have looked in /var/log/messages
as well.
where would this be logged?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО11-24-2010 03:09 AM
тАО11-24-2010 03:09 AM
Re: sudo -s Logging
from the man page:
-s [command]
The -s (shell) option runs the shell specified by the SHELL
environment variable if it is set or the shell as specified in
passwd(5). If a command is specified, it is passed to the shell
for execution. Otherwise, an interactive shell is executed.
So after the "sudo -s" has been executed without command, your are in the (root?) shell and the logs would be in the history file of the user.
If you are using bash, you can have it log all the commands in syslog.
HTH
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО11-24-2010 03:43 AM
тАО11-24-2010 03:43 AM
Re: sudo -s Logging
thanks for the reply but it does not log to .bash_history
found a man that says that it wont but i am not so sure that it cannot be done.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО11-24-2010 07:03 AM
тАО11-24-2010 07:03 AM
Re: sudo -s Logging
You would need one of the following:
- a modified shell that logs all commands, or
- kernel-level auditing that records the parameters of all commands executed, or
- a wrapper that records all the input and output of the privileged shell.
Sourceforge has "sudosh": http://sourceforge.net/projects/sudosh/files/
It acts as a wrapper between sudo and the shell and records all the input and output.
Instructions to configure it are in the README file within the sudosh source code package.
Once you have set up sudosh, you will have to change your winscp to use "sudo sudosh" instead of "sudo -s" (or replace the real "sudo" with a script that modifies the command line before the real "sudo" command is executed).
The sudosh package also includes "sudosh-replay", which allows you to view all recorded sudosh sessions in complete detail.
MK
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО11-24-2010 07:08 AM
тАО11-24-2010 07:08 AM
Re: sudo -s Logging
http://www.ibm.com/developerworks/aix/library/au-korn93/index.html
That's how our systems aer set up... when an admin "sudo -s -E" to root -- all commands aer logged "elsewhere"