howto log usage of shared account (root account) after `sudo su -`

drManhattan · 09-27-2011, 06:48 AM

Hi

I would like to have traceability of sys admins behavior during usage of shared account (root account).
How to log sys admins session after he changes identity via sudo mechanism (`sudo su -`) ?

thx for help.

droyden · 09-27-2011, 10:08 AM

Couple of options off the top of my head, either a patched bash shell which logs the details ( can be bypassed tho) or kernel level logging such using auditd and audit=1 on the kernel command line

drManhattan · 09-29-2011, 10:42 AM

Usage is described
here.

grim76 · 09-29-2011, 09:11 PM

http://www.gratisoft.us/sudo/

The sudo rpm that they have includes the ability to record sudo sessions. Problem is that those that have root access can edit the sudoers file and turn off recording, but it will at least be recorded to know what all was typed and done.

The bad thing about this approach is that you are replacing sudo for another implementation of sudo that did not come with your distribution.

drManhattan · 09-30-2011, 04:11 AM

PLease describe me howto log sudo session from this page, becasue I don't have time now to read it, if you of course can.

thx for help.

grim76 · 09-30-2011, 07:48 AM

There is a directive that you apply in the sudoers file that will record the session. Most implementations of sudo do not include it though. That is why I pointed you to the site that I did.