From owner-freebsd-questions@FreeBSD.ORG Wed Dec 19 04:10:17 2012 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id C81C0641 for ; Wed, 19 Dec 2012 04:10:17 +0000 (UTC) (envelope-from Devin.Teske@fisglobal.com) Received: from mx1.fisglobal.com (mx1.fisglobal.com [199.200.24.190]) by mx1.freebsd.org (Postfix) with ESMTP id 85DD08FC1A for ; Wed, 19 Dec 2012 04:10:17 +0000 (UTC) Received: from smtp.fisglobal.com ([10.132.206.31]) by ltcfislmsgpa03.fnfis.com (8.14.5/8.14.5) with ESMTP id qBJ4AGxx008371 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NOT); Tue, 18 Dec 2012 22:10:16 -0600 Received: from [10.0.0.102] (10.14.152.61) by smtp.fisglobal.com (10.132.206.31) with Microsoft SMTP Server (TLS) id 14.2.309.2; Tue, 18 Dec 2012 22:10:15 -0600 Subject: Re: Somewhat OT: Is Full Command Logging Possible? MIME-Version: 1.0 (Apple Message framework v1283) Content-Type: text/plain; charset="windows-1252" From: Devin Teske In-Reply-To: <50D12489.20507@tundraware.com> Date: Tue, 18 Dec 2012 20:10:01 -0800 Content-Transfer-Encoding: quoted-printable Message-ID: <77873574-DBFA-4A5E-A418-F3482EF0C643@fisglobal.com> References: <50BFD674.8000305@tundraware.com> <50BFDD51.5000100@tundraware.com> <20689.4087.859208.619511@gromit.timing.com> <50D113C0.3020607@tundraware.com> <50D115D9.6090608@tundraware.com> <57543CB2-2C92-434A-959B-C1CF5FC01600@fisglobal.com> <50D11BC4.5080803@tundraware.com> <50D12489.20507@tundraware.com> To: Tim Daneliuk X-Mailer: Apple Mail (2.1283) X-Originating-IP: [10.14.152.61] X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:5.9.8327, 1.0.431, 0.0.0000 definitions=2012-12-19_02:2012-12-18,2012-12-19,1970-01-01 signatures=0 Cc: FreeBSD Mailing List X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list Reply-To: Devin Teske List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 19 Dec 2012 04:10:17 -0000 On Dec 18, 2012, at 6:20 PM, Tim Daneliuk wrote: > On 12/18/2012 08:03 PM, Devin Teske wrote: >>=20 >> On Dec 18, 2012, at 5:43 PM, Tim Daneliuk wrote: >>=20 >>> On 12/18/2012 07:33 PM, Devin Teske wrote: >>>>=20 >>>> On Dec 18, 2012, at 5:18 PM, Tim Daneliuk wrote: >>>>=20 >>>=20 >>>>>>=20 >>>>>=20 >>>>> One further question, if I may. If I do this: >>>>>=20 >>>>> sudo su - >>>>>=20 >>>>> Will log_input record everything I do once I've been promoted to >>>>> root? I ask because my initial experiments seem to show that all >>>>> that's getting recorded is the content of the sudo command itself, >>>>> not the subsequent actions=85 >>>>>=20 >>>>=20 >>>> Correct, sudo is blind to the actions performed once the command reque= sted is executed (in this case, "su" and subsequently a shell followed by m= ore actions). >>>>=20 >>>=20 >>> Actually, I just tried this with both log_input and log_output options = enabled. >>> It seems that it *can* see into the promoted shell with a few caveats: >>>=20 >>> - Command output is logged immediately, but command inputs appear to o= nly >>> be written to the log when you exit the promoted shell. This may be >>> not quite right - there may have not been enough input to cause a >>> write flush to the log. >>>=20 >>> - The logging seems to be able to see into a spawned subshell, but >>> I don't think it can see input/output if you, say, kick off an xterm. >>>=20 >>=20 >> What about if you do "sudo vim" and then type ":sh" ? >=20 > Yep, I just tried that too. It catches that. It also catches > the in/output of subshells - like, say, kicking off sh interactively. > Similarly, if you're running text-based emacs, it catches the output > of spawning to a shell from there and doing things. >=20 > The only restriction I have run into so far, it that - for obvious > reasons - sudo cannot see into what you're doing if you kick off > an X application like xterm or graphical emacs, for instance. >=20 What about screen or tmux? (wondering if the transition into multiplexed sh= ell is anywhere as opaque as X11). --=20 Devin _____________ The information contained in this message is proprietary and/or confidentia= l. If you are not the intended recipient, please: (i) delete the message an= d all copies; (ii) do not disclose, distribute or use the message in any ma= nner; and (iii) notify the sender immediately. In addition, please be aware= that any message addressed to our domain is subject to archiving and revie= w by persons other than the intended recipient. Thank you.