Date: Fri, 7 Dec 2012 18:13:04 -0800 From: Devin Teske <devin.teske@fisglobal.com> To: Paul Schmehl <pschmehl_lists@tx.rr.com> Cc: n j <nino80@gmail.com>, Fleuriot Damien <ml@my.gd>, tundra@tundraware.com, FreeBSD Mailing List <freebsd-questions@freebsd.org> Subject: Re: Somewhat OT: Is Full Command Logging Possible? Message-ID: <8E7AE88A-5241-42CC-807F-FA42162EE83E@fisglobal.com> In-Reply-To: <FF701E50933D18DB396E2B33@Pauls-MacBook-Pro.local> References: <50BFD674.8000305@tundraware.com> <8BFA2629-45CA-491B-9BA8-E8AC78A4D66E@my.gd> <50BFDCFD.4010108@tundraware.com> <CALf6cgb0%2BGXrtTymOPOmjV_C2sk7EaGK=qJOF2z4mB3pQkzV_g@mail.gmail.com> <50C0EFA4.3010902@tundraware.com> <6A61448BD1FE69ED206EB42E@utd71538.campus.ad.utdallas.edu> <04283347-1955-4C49-9ADD-6D2FBB1B0EDC@my.gd> <FF701E50933D18DB396E2B33@Pauls-MacBook-Pro.local>
next in thread | previous in thread | raw e-mail | index | archive | help
On Dec 7, 2012, at 5:22 PM, Paul Schmehl wrote: > --On December 7, 2012 10:23:56 AM +0100 Fleuriot Damien <ml@my.gd> wrote: > >> >> On Dec 6, 2012, at 9:20 PM, Paul Schmehl <pschmehl_lists@tx.rr.com> wrote: >> >>> --On December 6, 2012 1:19:00 PM -0600 Tim Daneliuk >>> <tundra@tundraware.com> wrote: >>>> >>>> I understand this. Even the organization in question understands >>>> this. They are not trying to *prevent* any kind of access. All >>>> they're trying to do *log* it. Why? To meet some obscure >>>> compliance requirement they have to adhere to in order to >>>> remain in business. >>>> >>>> <rant> >>>> I know all of this is silly but that's our future when you >>>> let Our Fine Government regulate pretty much anything. >>>> </rant> >>>> >>> >>> I sent this last night, but for some reason it never showed up. >>> >>> /usr/ports/security/sudoscript >>> >>> I believe this will meet your requirements. >> >> >> I'm sorry to say it won't. >> Nothing will prevent a user from removing sudoscript's FIFO once he gets >> root privileges. >> > > Well, sure, but, if someone logs in and sudos to root, that will be logged by sudoscript. If the logging then ceases, that would be cause for disciplinary action up to and including dismissal. > What about the case of: sudo vim or sudo vim file Surely that wouldn't raise an eyebrow, but… Then execute within vim: :sh or ^_^ -- Devin … and another gem … sr env HOME=$HOME vim then :E _____________ The information contained in this message is proprietary and/or confidential. If you are not the intended recipient, please: (i) delete the message and all copies; (ii) do not disclose, distribute or use the message in any manner; and (iii) notify the sender immediately. In addition, please be aware that any message addressed to our domain is subject to archiving and review by persons other than the intended recipient. Thank you.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?8E7AE88A-5241-42CC-807F-FA42162EE83E>