[SOLVED] How do i log all commands run by a user after elevating himself as root using sudo

Arvind Shivaramakrishnan · 03-11-2015, 02:42 AM

Hi All,
I have added the following entry "Defaults logfile=/var/log/sudo.log" to the "/etc/sudoers" file and it logs whenever a user runs "sudo su - root" to elevate himself as root. But it doesnt log any other command after that the user executes in that sudo session. How do log all commands into sudo log file even after the root shell is assigned to the user.

T3RM1NVT0R · 03-11-2015, 03:26 AM

I think this is what you are looking for: http://sharadchhetri.com/2011/12/02/...ndary-logging/

However, if you are giving any person root privilege he/she can mess up with these files as well. It is not advisable to give any user sudo su - or sudo su - root or sudo /bin/bash access.

What I am trying to say is no matter what security measure you put in if the user will have full root access he / she can anyways manipulate / mess the logs files as well. So better never ever give any user full root access.

Arvind Shivaramakrishnan · 03-11-2015, 04:46 AM

Thanks. That worked!!