LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Server
User Name
Password
Linux - Server This forum is for the discussion of Linux Software used in a server related context.

Notices

Reply
 
Search this Thread
Old 09-27-2011, 06:48 AM   #1
drManhattan
Member
 
Registered: Aug 2010
Location: Warsaw, Poland
Distribution: Ubuntu 10.04 LTS on IBM Lenovo R61e, RHEL5-6,SLES10-11
Posts: 249

Rep: Reputation: 1
howto log usage of shared account (root account) after `sudo su -`


Hi

I would like to have traceability of sys admins behavior during usage of shared account (root account).
How to log sys admins session after he changes identity via sudo mechanism (`sudo su -`) ?

thx for help.
 
Old 09-27-2011, 10:08 AM   #2
droyden
Member
 
Registered: Feb 2007
Location: UK
Posts: 150

Rep: Reputation: 19
Couple of options off the top of my head, either a patched bash shell which logs the details ( can be bypassed tho) or kernel level logging such using auditd and audit=1 on the kernel command line
 
Old 09-29-2011, 10:42 AM   #3
drManhattan
Member
 
Registered: Aug 2010
Location: Warsaw, Poland
Distribution: Ubuntu 10.04 LTS on IBM Lenovo R61e, RHEL5-6,SLES10-11
Posts: 249

Original Poster
Rep: Reputation: 1
Usage is described
here.
 
Old 09-29-2011, 09:11 PM   #4
grim76
Member
 
Registered: Jun 2007
Distribution: Debian, SLES, Ubuntu
Posts: 264

Rep: Reputation: 42
http://www.gratisoft.us/sudo/

The sudo rpm that they have includes the ability to record sudo sessions. Problem is that those that have root access can edit the sudoers file and turn off recording, but it will at least be recorded to know what all was typed and done.

The bad thing about this approach is that you are replacing sudo for another implementation of sudo that did not come with your distribution.
 
Old 09-30-2011, 04:11 AM   #5
drManhattan
Member
 
Registered: Aug 2010
Location: Warsaw, Poland
Distribution: Ubuntu 10.04 LTS on IBM Lenovo R61e, RHEL5-6,SLES10-11
Posts: 249

Original Poster
Rep: Reputation: 1
PLease describe me howto log sudo session from this page, becasue I don't have time now to read it, if you of course can.

thx for help.
 
Old 09-30-2011, 07:48 AM   #6
grim76
Member
 
Registered: Jun 2007
Distribution: Debian, SLES, Ubuntu
Posts: 264

Rep: Reputation: 42
There is a directive that you apply in the sudoers file that will record the session. Most implementations of sudo do not include it though. That is why I pointed you to the site that I did.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
All parties in the matter of Sudo v. Root Account please rise... Kenny_Strawn Linux - General 64 04-20-2011 05:51 AM
After improper shutdown, 1 user can't startx (KDE), sudo, OR su. Root account is ok! ShellyCat Linux - Desktop 2 09-19-2010 03:56 AM
Can't use sudo, only account that's not root is not a sudo'ers [Ubuntu 9.10] randyriver10 Linux - Desktop 1 01-09-2010 07:56 PM
"To add a new user account, log in to the root account" how do i do this (im new) pierce77x Linux - Newbie 4 12-28-2008 02:44 PM
is it legitimate and allowed and can be done to make another user account set uid and gid to null 0 to make another root account with different name and possibly not damage the debian system creating and using that new account BenJoBoy Linux - Newbie 12 01-29-2006 10:02 AM


All times are GMT -5. The time now is 01:07 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration