sudo logging

satinet · 10-19-2005, 10:51 AM

Hello,

I am setting up sudo on a server. It's working very smoothly so far. I'm still in the testing phase. When try to 'sudo' a command that the user is not authorised to run, the warning goes to a log file. However, it also echos to the root user's tty, which is really really not what i want to happen.

Here is my /etc/sudoers file:

Code:

Defaults        logfile=/var/run/sudo/sudo.log, mailto="admin@domain.com" 
Cmnd_Alias   ADDUSER=/ops/adduser

# User privilege specification
root    ALL=(ALL) ALL

# Members of the admin group may gain root privileges
%sdesk ALL=NOPASSWD:/sbin/passwd,ADDUSER

Can anyone give me any hints?

Many thanks.

Tom

unSpawn · 10-20-2005, 11:04 PM

However, it also echos to the root user's tty, which is really really not what i want to happen.
dmesg -n[number]?

satinet · 10-21-2005, 02:51 AM

thanks for you tip.

however, the problem is that a failure event is treated as an 'event'. if you see below this kind of event gets echoed to root's terminal because of how i have /etc/syslog.conf set up.

from http://www.courtesan.com/sudo/man/sudoers.html#defaults

syslog_badpri
Syslog priority to use when user authenticates unsuccessfully. Defaults to alert.

# @(#)B.11.11_LR
#
# syslogd configuration file.
#
# See syslogd(1M) for information about the format of this file.
#
mail.debug /var/adm/syslog/mail.log
*.info;mail.none /var/adm/syslog/syslog.log
*.alert /dev/console
*.alert root
*.emerg *

unSpawn · 10-21-2005, 04:37 AM

if you see below this kind of event gets echoed to root's terminal because of how i have /etc/syslog.conf set up.
Yeah, that would have been my second guess.

It's all going to file, which should mean you're using some reporting tool to filter the logs and send alerts to people, so why not disable the console line? No one should be on the root console all the time anyway.

satinet · 10-21-2005, 05:56 AM

yeah, it was my own over exurberance.

Well, it's hp-ux - i've got no real alternative to logging in as root using telnet (!). The app we run can't even use shadow passwords! haha.

Anyway, i think i acutally want to know if someone manages to do a wrong sudo, as no one actually has access to the terminal.

we don't use a reporting tool as such. Thanks for your input.

FYI this is run from a menu within a FAT client. the service desk will be creating using accounts..... lol... melt down time.......