Logging all commands after a sudo su-

Thread Tools Search this Thread
Top Forums UNIX for Advanced & Expert Users Logging all commands after a sudo su-
# 1  
Old 11-07-2002
Question Logging all commands after a sudo su-

Hi there,

It might seem tricky, I confess.

We use sudo to allow people to initiate priviledged commands (but not all commands) on our Unix systems.

To by pass this, some people initiate the sudo su - command ;

The main issue is to 'know' what those people do when they gain root access.

Is there a way to have a log of all commands done by a user whent they have gained root access? This way, we could at least know what they do.

# 2  
Old 11-07-2002
Logging commands is a part of many packages, including ACL extensions. Your question is too general because you did not specify the OS.

Also, try the logfile options available in the sudoers configuration file and see if there is anything there to help you.

If you restrict the sudo configuration to a bare minimum number of commands per user, you should be ok with standard sudoers logging.

man sudoers

In other words, you should not give sudoers permission to use vi.

This is discussed in the sudo man page:

There is no easy way to prevent a user from gaining a root shell if that user has access to commands allowing shell escapes.

If users have sudo ALL there is nothing to prevent them from creating their own program that gives them a root shell regardless of any '!' elements in the user specification.

Running shell scripts via sudo can expose the same kernel bugs that make setuid shell scripts unsafe on some operating systems (if your OS supports the /dev/fd/ directory, setuid shell scripts are generally safe).
So... don't give users permissions to programs that allow shell escapes...... Heck, on our systems, no one is allowed to sudo... and if they were, they would be given very limited command privs.... (certainly not vi !)

... and not su Smilie
# 3  
Old 11-07-2002
Re: Logging all commands after a sudo su-

Originally posted by linuxmtl
To by pass this, some people initiate the sudo su - command ;
If people can do that then why do they need sudo? I suggest you look at sudoers carefully and set it up correctly so that cannot happen.
# 4  
Old 11-11-2002
Hammer & Screwdriver

We use Solaris OS here.

Some of our sudoers have found that they can just enter ;

sudo su -

So they become root.

What bothers us more is the fact that when they have done so they is now way we can trace back each command a user as done while they are root.

I am looking for a way to permit some users do become root (sudo su - or simply su) if we can trace what they do while they are root.

Is this possible?

# 5  
Old 11-11-2002
Yes, you need to configure the sudoers configuration file and restrict what users do and how they are logged.

You have NOT discovered a 'back door' you have SIMPLY not configured sudo and sudoers properly. (see post above).
Login or Register to Ask a Question

Previous Thread | Next Thread

10 More Discussions You Might Find Interesting

1. Solaris

Sudo logging need year details also

Hi All I have a requirement in which during sudo logging, I must get the year details also in sudo log file. As below output is not mentioning the year due to this I will not able to idenfiy that this log belong to 2012 or 2011 or 2010 Dec 12 11:30:21 XYZ sudo: user1 : TTY=pts/5 ;... (4 Replies)
Discussion started by: sb200
4 Replies

2. Shell Programming and Scripting

How to run sudo commands under a script?

Hi, I am new to scripting. I am trying to write a script to ssh one remote machine and run a sudo command. ssh <hostname> sudo -S <command> < ~/pass.txt I am stored my password in pass.txt. I am getting error sudo: no tty present and no askpass program specified Please suggest me how can... (1 Reply)
Discussion started by: venkia9
1 Replies

3. Programming

Using Commands over SSH using Sudo

Is there a way to transfer my sudo password via ssh so that I can copy files remotely and pass them locally, so: cat sudo-passwd-file|ssh -t user@ 'sudo find / -depth|cpio -oacv|gzip' > /path/to/dir/file.cpio.gz I am in the process of a creating a script. Everytime I try and just... (16 Replies)
Discussion started by: metallica1973
16 Replies

4. UNIX for Dummies Questions & Answers

sudo commands list

Hi, Can you please give me a list of commands executed through 'sudo' command, thank you. (1 Reply)
Discussion started by: Dev_Dev
1 Replies

5. UNIX for Advanced & Expert Users

change io logging directory sudo 1.7.4p6

There was an update in sudo 1.7.5 : -The I/O log directory may now be specified in the sudoers file. I am stuck using sudo 1.7.4p6. Because it is supported by HP on thier HP-UX builds. Is there a process to change this directory in sudo 1.7.4p6? currently sudo 1.7.4p6's default is... (3 Replies)
Discussion started by: trimike
3 Replies

6. Shell Programming and Scripting

logging into server and excute commands

hi all, I am new to unix and unix scipting. i need a script to logging into servers and to excute some commands in each server. for eg : I tried with below script ,but cant get the desired o/p. please help with this for i in `cat serverlist` do echo $i ssh $i uname -a ; cat... (4 Replies)
Discussion started by: sudharson
4 Replies

7. Cybersecurity

Logging shell commands and send it out

Dear friends I'm looking for a solution to log all commands that users do in my RedHat box, and send it out to other remote server, Is there any guide for that Thanks ---------- Post updated at 04:20 AM ---------- Previous update was at 03:47 AM ---------- I can think of something else I... (7 Replies)
Discussion started by: reaky
7 Replies

8. HP-UX

sudo or su logging

Jul 14 08:02:40 servera sshd: Accepted keyboard-interactive/pam for someuser from x.x.x.x port 1406 ssh2 Jul 14 08:02:48 servera su: - 1 someuser-root Jul 14 08:03:03 servera sudo: someuser : TTY=pts/1 ; PWD=/home/someuser ; USER=root ; COMMAND=/usr/bin/su - Jul 14 08:03:03 servera su: + 1... (3 Replies)
Discussion started by: Ikon
3 Replies

9. Solaris

Logging commands and output

I'm looking for a CLI utility that will capture all the commands you type at the Solaris CLI (and their output) into a file. I'm sure it's called "scripter", but I can't find anything on a command called scripter. Does anyone know of a such a command? Your help will be greatly... (3 Replies)
Discussion started by: soliberus
3 Replies

10. UNIX for Dummies Questions & Answers

sudo logging + NFS hang?

Hi all, I have two problems, My system is SunOS 5.9: 1- I have installed sudo but I have a problem logging user activities on other hosts, the way I installed it is that I installed sudo and the sudoers file in a shared directory on a NFS server which is mounted by all computers on the... (1 Reply)
Discussion started by: neked
1 Replies
Login or Register to Ask a Question