From owner-freebsd-questions@FreeBSD.ORG Sat Dec 8 01:22:13 2012 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 3516BD55 for ; Sat, 8 Dec 2012 01:22:13 +0000 (UTC) (envelope-from pschmehl_lists@tx.rr.com) Received: from cdptpa-omtalb.mail.rr.com (cdptpa-omtalb.mail.rr.com [75.180.132.120]) by mx1.freebsd.org (Postfix) with ESMTP id D98BE8FC13 for ; Sat, 8 Dec 2012 01:22:11 +0000 (UTC) X-Authority-Analysis: v=2.0 cv=a52yBDuF c=1 sm=0 a=+L5dYfeubEW4PLvjDgtIXQ==:17 a=WAZfUmVf-EkA:10 a=CTRC7nxYIvUA:10 a=05ChyHeVI94A:10 a=kj9zAlcOel0A:10 a=ayC55rCoAAAA:8 a=cd2htP0gDKkA:10 a=MnkTnmICAAAA:8 a=UdvEN9gbqWsBAELrqE0A:9 a=CjuIK1q_8ugA:10 a=VAeyC-Qft3gA:10 a=+L5dYfeubEW4PLvjDgtIXQ==:117 X-Cloudmark-Score: 0 X-Authenticated-User: X-Originating-IP: 76.184.157.127 Received: from [76.184.157.127] ([76.184.157.127:57219] helo=[10.0.0.6]) by cdptpa-oedge01.mail.rr.com (envelope-from ) (ecelerity 2.2.3.46 r()) with ESMTP id 38/B9-00785-04692C05; Sat, 08 Dec 2012 01:22:10 +0000 Date: Fri, 07 Dec 2012 19:22:07 -0600 From: Paul Schmehl To: Fleuriot Damien , Paul Schmehl Subject: Re: Somewhat OT: Is Full Command Logging Possible? Message-ID: In-Reply-To: <04283347-1955-4C49-9ADD-6D2FBB1B0EDC@my.gd> References: <50BFD674.8000305@tundraware.com> <8BFA2629-45CA-491B-9BA8-E8AC78A4D66E@my.gd> <50BFDCFD.4010108@tundraware.com> <50C0EFA4.3010902@tundraware.com> <6A61448BD1FE69ED206EB42E@utd71538.campus.ad.utdallas.edu> <04283347-1955-4C49-9ADD-6D2FBB1B0EDC@my.gd> X-Mailer: Mulberry/4.0.8 (Mac OS X) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Content-Disposition: inline Cc: n j , tundra@tundraware.com, FreeBSD Mailing List X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list Reply-To: Paul Schmehl List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 08 Dec 2012 01:22:13 -0000 --On December 7, 2012 10:23:56 AM +0100 Fleuriot Damien wrote: > > On Dec 6, 2012, at 9:20 PM, Paul Schmehl wrote: > >> --On December 6, 2012 1:19:00 PM -0600 Tim Daneliuk >> wrote: >>> >>> I understand this. Even the organization in question understands >>> this. They are not trying to *prevent* any kind of access. All >>> they're trying to do *log* it. Why? To meet some obscure >>> compliance requirement they have to adhere to in order to >>> remain in business. >>> >>> >>> I know all of this is silly but that's our future when you >>> let Our Fine Government regulate pretty much anything. >>> >>> >> >> I sent this last night, but for some reason it never showed up. >> >> /usr/ports/security/sudoscript >> >> I believe this will meet your requirements. > > > I'm sorry to say it won't. > Nothing will prevent a user from removing sudoscript's FIFO once he gets > root privileges. > Well, sure, but, if someone logs in and sudos to root, that will be logged by sudoscript. If the logging then ceases, that would be cause for disciplinary action up to and including dismissal. Not all problems can be solved with technology. Paul Schmehl, Senior Infosec Analyst As if it wasn't already obvious, my opinions are my own and not those of my employer. ******************************************* "It is as useless to argue with those who have renounced the use of reason as to administer medication to the dead." Thomas Jefferson "There are some ideas so wrong that only a very intelligent person could believe in them." George Orwell