From owner-freebsd-questions@FreeBSD.ORG Wed Dec 19 04:21:39 2012 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 135149B2 for ; Wed, 19 Dec 2012 04:21:39 +0000 (UTC) (envelope-from tundra@tundraware.com) Received: from ozzie.tundraware.com (ozzie.tundraware.com [75.145.138.73]) by mx1.freebsd.org (Postfix) with ESMTP id BFFBA8FC12 for ; Wed, 19 Dec 2012 04:21:38 +0000 (UTC) Received: from [192.168.0.2] (viper.tundraware.com [192.168.0.2]) (authenticated bits=0) by ozzie.tundraware.com (8.14.5/8.14.5) with ESMTP id qBJ4LQQ6018759 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NO) for ; Tue, 18 Dec 2012 22:21:26 -0600 (CST) (envelope-from tundra@tundraware.com) Message-ID: <50D140C6.6080602@tundraware.com> Date: Tue, 18 Dec 2012 22:21:26 -0600 From: Tim Daneliuk User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:17.0) Gecko/17.0 Thunderbird/17.0 MIME-Version: 1.0 To: FreeBSD Mailing List Subject: Re: Somewhat OT: Is Full Command Logging Possible? References: <50BFD674.8000305@tundraware.com> <50BFDD51.5000100@tundraware.com> <20689.4087.859208.619511@gromit.timing.com> <50D113C0.3020607@tundraware.com> <50D115D9.6090608@tundraware.com> <57543CB2-2C92-434A-959B-C1CF5FC01600@fisglobal.com> <50D11BC4.5080803@tundraware.com> <50D12489.20507@tundraware.com> <77873574-DBFA-4A5E-A418-F3482EF0C643@fisglobal.com> In-Reply-To: <77873574-DBFA-4A5E-A418-F3482EF0C643@fisglobal.com> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 8bit X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.2.7 (ozzie.tundraware.com [192.168.0.1]); Tue, 18 Dec 2012 22:21:26 -0600 (CST) X-TundraWare-MailScanner-Information: Please contact the ISP for more information X-TundraWare-MailScanner-ID: qBJ4LQQ6018759 X-TundraWare-MailScanner: Found to be clean X-TundraWare-MailScanner-From: tundra@tundraware.com X-Spam-Status: No X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 19 Dec 2012 04:21:39 -0000 On 12/18/2012 10:10 PM, Devin Teske wrote: > > On Dec 18, 2012, at 6:20 PM, Tim Daneliuk wrote: > >> On 12/18/2012 08:03 PM, Devin Teske wrote: >>> >>> On Dec 18, 2012, at 5:43 PM, Tim Daneliuk wrote: >>> >>>> On 12/18/2012 07:33 PM, Devin Teske wrote: >>>>> >>>>> On Dec 18, 2012, at 5:18 PM, Tim Daneliuk wrote: >>>>> >>>> >>>>>>> >>>>>> >>>>>> One further question, if I may. If I do this: >>>>>> >>>>>> sudo su - >>>>>> >>>>>> Will log_input record everything I do once I've been promoted to >>>>>> root? I ask because my initial experiments seem to show that all >>>>>> that's getting recorded is the content of the sudo command itself, >>>>>> not the subsequent actions… >>>>>> >>>>> >>>>> Correct, sudo is blind to the actions performed once the command requested is executed (in this case, "su" and subsequently a shell followed by more actions). >>>>> >>>> >>>> Actually, I just tried this with both log_input and log_output options enabled. >>>> It seems that it *can* see into the promoted shell with a few caveats: >>>> >>>> - Command output is logged immediately, but command inputs appear to only >>>> be written to the log when you exit the promoted shell. This may be >>>> not quite right - there may have not been enough input to cause a >>>> write flush to the log. >>>> >>>> - The logging seems to be able to see into a spawned subshell, but >>>> I don't think it can see input/output if you, say, kick off an xterm. >>>> >>> >>> What about if you do "sudo vim" and then type ":sh" ? >> >> Yep, I just tried that too. It catches that. It also catches >> the in/output of subshells - like, say, kicking off sh interactively. >> Similarly, if you're running text-based emacs, it catches the output >> of spawning to a shell from there and doing things. >> >> The only restriction I have run into so far, it that - for obvious >> reasons - sudo cannot see into what you're doing if you kick off >> an X application like xterm or graphical emacs, for instance. >> > > What about screen or tmux? (wondering if the transition into multiplexed shell is anywhere as opaque as X11). > It definitely works if you are in a screen session and sudo su - from there. I have not tried promoting myself to root and THEN starting the screen session (I don't use tmux). -- ---------------------------------------------------------------------------- Tim Daneliuk tundra@tundraware.com PGP Key: http://www.tundraware.com/PGP/