Track userid of person using sudo

hvwolfman · 05-24-2013, 08:26 AM

I am trying to see if there is a way to tell what user used sudo to do work on the server. I need to know if there is a log file that has the userid of the person who invoked sudo to make changes in the system.

Thanks

bloodstreetboy · 05-24-2013, 08:58 AM

It is hard to know but you can search keyword sudo in .bash_history of all users, it will give you the list.
As well as you can save their history in separate files(make a cron job for it) so if they delete their history even you can know who has used sudo.

shivaa · 05-24-2013, 09:40 AM

Sudo log file is typically find as /var/adm/sulog or it could exist as /var/log/sudo.log.

Also you can check /etc/sudoers file and check who're there and what access they have.

Further, if you want to check what sudo privilage a user has, just invoke:

Code:

~$ sudo -l

bigrigdriver · 05-24-2013, 09:55 AM

You may also have file /var/log/auth.log which will show which users use sudo.

rtmistler · 05-24-2013, 11:07 AM

By the way, who says that someone has to use sudo to make changes to your server? What if they already know the root password?

bigrigdriver · 05-24-2013, 06:01 PM

@rtmistler

Quote:

By the way, who says that someone has to use sudo to make changes to your server? What if they already know the root password?

/var/log/auth.log will still show the name of the user who logged in as root user, or who used sudo.

fortran · 05-25-2013, 01:23 AM

As bigrigdriver suggested

Quote:

Originally Posted by bigrigdriver

You may also have file /var/log/auth.log which will show which users use sudo.

As you didn't mention your distro, just for your information
In centOS/fedora/RHEL filename is

Quote:

/var/log/secure

rtmistler · 05-28-2013, 07:23 AM

Quote:

/var/log/auth.log will still show the name of the user who logged in as root user, or who used sudo.

Yep, auth.log shows when root logged in or sudo...

Code:

root@desktop:/home/user# cat /var/log/auth.log
May 28 08:12:20 desktop sudo:   user : TTY=pts/1 ; PWD=/home/user ; USER=root ; COMMAND=/bin/cat /var/log/auth.log
May 28 08:12:25 desktop su[6137]: Successful su for root by user
May 28 08:12:25 desktop su[6137]: + /dev/pts/1 user:root
May 28 08:12:25 desktop su[6137]: pam_unix(su:session): session opened for user root by root(uid=1001)

Lookee what I can do...

Code:

root@desktop:/home/user# vi /var/log/auth.log

Guess what auth.log contains now that I've edited it...

Code:

root@desktop:/home/user# cat /var/log/auth.log

At this point I wonder what the original requesting person's intentions were. To spy, to monitor, or to administer in some fashion. I mean, there's a lot more to system/network security other than determining who has performed a sudo command to reconfigure something.

eklavya · 05-28-2013, 07:43 AM

Quote:

Originally Posted by rtmistler

Code:

root@desktop:/home/user# vi /var/log/auth.log

Guess what auth.log contains now that I've edited it...

But you are logged in as a root and here we are talking about user updates the file or not.
You have taken example of command line using vi, that is really good to explain my point.

If you are a user, you need to use sudo again to remove contents of the file and once you use sudo, it makes an entry in auth.log so next time when you open the file, you see user has edited the file auth.log, something like this.

Code:

May 28 18:05:23 user-desktop sudo:     user : TTY=pts/1 ; PWD=/home/user ; USER=root ; COMMAND=/usr/bin/nano /var/log/auth.log

If you edit this line, next time when you open the file and it shows about your previous editing using sudo.
It means you can't remove your last activity (especially if you have edited auth.log).

It means admin can know about user's act that user has done something inappropriate that's why he/she has removed the entry from auth.log

bloodstreetboy · 05-28-2013, 08:07 AM

Quote:

Originally Posted by rtmistler

At this point I wonder what the original requesting person's intentions were. To spy, to monitor, or to administer in some fashion. I mean, there's a lot more to system/network security other than determining who has performed a sudo command to reconfigure something.

That's why in large and professional organizations, they never give sudo facility to users.

If user tries to use sudo, it says

Code:

username is not in the sudoers file. This incident will be reported.

You have to request by mail to perform your task. Then admin does it for you.
They prefer delay than the damage.

Habitual · 05-28-2013, 02:14 PM

Quote:

Originally Posted by bloodstreetboy

users.

Great, now they are awake.