From owner-freebsd-questions@FreeBSD.ORG Wed Dec 19 01:18:26 2012 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 69C208E4 for ; Wed, 19 Dec 2012 01:18:26 +0000 (UTC) (envelope-from tundra@tundraware.com) Received: from ozzie.tundraware.com (ozzie.tundraware.com [75.145.138.73]) by mx1.freebsd.org (Postfix) with ESMTP id 096F48FC13 for ; Wed, 19 Dec 2012 01:18:25 +0000 (UTC) Received: from [192.168.0.2] (viper.tundraware.com [192.168.0.2]) (authenticated bits=0) by ozzie.tundraware.com (8.14.5/8.14.5) with ESMTP id qBJ1IH6Q015360 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NO) for ; Tue, 18 Dec 2012 19:18:17 -0600 (CST) (envelope-from tundra@tundraware.com) Message-ID: <50D115D9.6090608@tundraware.com> Date: Tue, 18 Dec 2012 19:18:17 -0600 From: Tim Daneliuk User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:17.0) Gecko/17.0 Thunderbird/17.0 MIME-Version: 1.0 To: FreeBSD Mailing List Subject: Re: Somewhat OT: Is Full Command Logging Possible? References: <50BFD674.8000305@tundraware.com> <50BFDD51.5000100@tundraware.com> <20689.4087.859208.619511@gromit.timing.com> <50D113C0.3020607@tundraware.com> In-Reply-To: <50D113C0.3020607@tundraware.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.2.7 (ozzie.tundraware.com [192.168.0.1]); Tue, 18 Dec 2012 19:18:17 -0600 (CST) X-TundraWare-MailScanner-Information: Please contact the ISP for more information X-TundraWare-MailScanner-ID: qBJ1IH6Q015360 X-TundraWare-MailScanner: Found to be clean X-TundraWare-MailScanner-From: tundra@tundraware.com X-Spam-Status: No X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 19 Dec 2012 01:18:26 -0000 On 12/18/2012 07:09 PM, Tim Daneliuk wrote: > On 12/18/2012 06:53 PM, John Hein wrote: >> Tim Daneliuk wrote at 17:48 -0600 on Dec 5, 2012: >> > On 12/05/2012 05:44 PM, Kurt Buff wrote: >> > > On Wed, Dec 5, 2012 at 3:19 PM, Tim Daneliuk wrote: >> > >> I am working with an institution that today provides limited privilege >> > >> escalation >> > >> on their servers via very specific sudo rules. The problem is that the >> > >> administrators can do 'sudo su -'. >> > > >> > > >> > > >> > > sudo is misconfigured. >> > > >> > > man 5 sudoers and man 8 visudo >> > > >> > > >> > > >> > > Kurt >> > > >> > >> > I'm sorry Kurt, I'm sort of dense today, I'm not sure what you're >> > saying. Are you suggesting that there is a way to configure >> > sudo so that if someone does 'sudo su -' to become an admin, >> > sudo can be made to log every command they execute thereafter? >> >> See log_input and log_output in sudoers(5) > > Thanks so much John, that's the secret sauce I was looking for... > > One further question, if I may. If I do this: sudo su - Will log_input record everything I do once I've been promoted to root? I ask because my initial experiments seem to show that all that's getting recorded is the content of the sudo command itself, not the subsequent actions... -- ---------------------------------------------------------------------------- Tim Daneliuk tundra@tundraware.com PGP Key: http://www.tundraware.com/PGP/