From owner-freebsd-questions@FreeBSD.ORG Sat Dec 8 10:39:20 2012 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 7CD37BB5 for ; Sat, 8 Dec 2012 10:39:20 +0000 (UTC) (envelope-from ml@my.gd) Received: from mail-wi0-f180.google.com (mail-wi0-f180.google.com [209.85.212.180]) by mx1.freebsd.org (Postfix) with ESMTP id F348B8FC13 for ; Sat, 8 Dec 2012 10:39:19 +0000 (UTC) Received: by mail-wi0-f180.google.com with SMTP id hj13so157958wib.13 for ; Sat, 08 Dec 2012 02:39:12 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=references:in-reply-to:mime-version:content-transfer-encoding :content-type:message-id:cc:x-mailer:from:subject:date:to :x-gm-message-state; bh=ibz8Bsu5p50L0lFAztoEovrh3DYpF+d+Fj/94EQ3KFM=; b=A+28BpxnA6BogehshtBUQlI37t0surde5FSgti8jNsq8LJSoGVB3mq5Oh0qygcZGu6 PaUbSYu4Gmetfw4HrdepfJ10rYml8pIfVdIKH+Rtz9BXWadfEXVanOT8qya8faQF4+Ek w3iuHOD/vx+EKQLyfZi/K7cSfSvgE5QU2dJRYEO50nOPSPBvom7eAPYsXQ/gO7SaEITu +O3k2fJaFeYw/bHYY8TsDQU9dp/9/sNaCgWF8liehTbFJSUYoRP/K5eA7bvbhe5skfbw v5CobmuMr5auNITtzpURpd4HpIyVSjEHqMubLAq4zBoqrhjZMOm8MELz78hQx6jetR0a qxMA== Received: by 10.180.86.39 with SMTP id m7mr2620636wiz.1.1354963152796; Sat, 08 Dec 2012 02:39:12 -0800 (PST) Received: from [10.41.48.50] ([92.90.16.94]) by mx.google.com with ESMTPS id eo10sm1959409wib.9.2012.12.08.02.39.11 (version=TLSv1/SSLv3 cipher=OTHER); Sat, 08 Dec 2012 02:39:12 -0800 (PST) References: <50BFD674.8000305@tundraware.com> <8BFA2629-45CA-491B-9BA8-E8AC78A4D66E@my.gd> <50BFDCFD.4010108@tundraware.com> <50C0EFA4.3010902@tundraware.com> <6A61448BD1FE69ED206EB42E@utd71538.campus.ad.utdallas.edu> <04283347-1955-4C49-9ADD-6D2FBB1B0EDC@my.gd> <8E7AE88A-5241-42CC-807F-FA42162EE83E@fisglobal.com> In-Reply-To: <8E7AE88A-5241-42CC-807F-FA42162EE83E@fisglobal.com> Mime-Version: 1.0 (1.0) Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Message-Id: X-Mailer: iPhone Mail (9A405) From: Damien Fleuriot Subject: Re: Somewhat OT: Is Full Command Logging Possible? Date: Sat, 8 Dec 2012 11:38:30 +0100 To: Devin Teske X-Gm-Message-State: ALoCoQm+P28fe5xXbbJF2U1RYXxWq/VrdUKSm8bVUFawABdzF8mgSpOSSjKib9a7w6f425lhP1Kb Cc: Paul Schmehl , "" , FreeBSD Mailing List , n j X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 08 Dec 2012 10:39:20 -0000 On 8 Dec 2012, at 03:13, Devin Teske wrote: >=20 > On Dec 7, 2012, at 5:22 PM, Paul Schmehl wrote: >=20 >> --On December 7, 2012 10:23:56 AM +0100 Fleuriot Damien wrote:= >>=20 >>>=20 >>> On Dec 6, 2012, at 9:20 PM, Paul Schmehl wrot= e: >>>=20 >>>> --On December 6, 2012 1:19:00 PM -0600 Tim Daneliuk >>>> wrote: >>>>>=20 >>>>> I understand this. Even the organization in question understands >>>>> this. They are not trying to *prevent* any kind of access. All >>>>> they're trying to do *log* it. Why? To meet some obscure >>>>> compliance requirement they have to adhere to in order to >>>>> remain in business. >>>>>=20 >>>>> >>>>> I know all of this is silly but that's our future when you >>>>> let Our Fine Government regulate pretty much anything. >>>>> >>>>>=20 >>>>=20 >>>> I sent this last night, but for some reason it never showed up. >>>>=20 >>>> /usr/ports/security/sudoscript >>>>=20 >>>> I believe this will meet your requirements. >>>=20 >>>=20 >>> I'm sorry to say it won't. >>> Nothing will prevent a user from removing sudoscript's FIFO once he gets= >>> root privileges. >>>=20 >>=20 >> Well, sure, but, if someone logs in and sudos to root, that will be logge= d by sudoscript. If the logging then ceases, that would be cause for discip= linary action up to and including dismissal. >>=20 >=20 > What about the case of: >=20 > sudo vim >=20 > or >=20 > sudo vim file >=20 > Surely that wouldn't raise an eyebrow, but=E2=80=A6 >=20 > Then execute within vim: >=20 > :sh >=20 > or >=20 > ^_^ > --=20 > Devin >=20 > =E2=80=A6 and another gem =E2=80=A6 >=20 > sr env HOME=3D$HOME vim >=20 > then >=20 > :E >=20 My point exactly, such levels of protection can't be reached on our day to d= ay OSes. The only thing that can be done is trying to approach the expected level of s= crutiny and security. The audit framework is a viable solution IMO, as long as it has limited prot= ection against kills (restart it, send a SMS alert...)=