Date: Tue, 18 Dec 2012 18:03:30 -0800 From: Devin Teske <devin.teske@fisglobal.com> To: Tim Daneliuk <tundra@tundraware.com> Cc: FreeBSD Mailing List <freebsd-questions@freebsd.org> Subject: Re: Somewhat OT: Is Full Command Logging Possible? Message-ID: <F8791D4C-8753-469D-8926-3A6B81E7AB51@fisglobal.com> In-Reply-To: <50D11BC4.5080803@tundraware.com> References: <50BFD674.8000305@tundraware.com> <CADy1Ce5CCA4ExOok4DndA4C-MazbegZY1OKztCNqUZHGzLJgTA@mail.gmail.com> <50BFDD51.5000100@tundraware.com> <20689.4087.859208.619511@gromit.timing.com> <50D113C0.3020607@tundraware.com> <50D115D9.6090608@tundraware.com> <57543CB2-2C92-434A-959B-C1CF5FC01600@fisglobal.com> <50D11BC4.5080803@tundraware.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Dec 18, 2012, at 5:43 PM, Tim Daneliuk wrote: > On 12/18/2012 07:33 PM, Devin Teske wrote: >>=20 >> On Dec 18, 2012, at 5:18 PM, Tim Daneliuk wrote: >>=20 >=20 >>>>=20 >>>=20 >>> One further question, if I may. If I do this: >>>=20 >>> sudo su - >>>=20 >>> Will log_input record everything I do once I've been promoted to >>> root? I ask because my initial experiments seem to show that all >>> that's getting recorded is the content of the sudo command itself, >>> not the subsequent actions=85 >>>=20 >>=20 >> Correct, sudo is blind to the actions performed once the command request= ed is executed (in this case, "su" and subsequently a shell followed by mor= e actions). >>=20 >=20 > Actually, I just tried this with both log_input and log_output options en= abled. > It seems that it *can* see into the promoted shell with a few caveats: >=20 > - Command output is logged immediately, but command inputs appear to only > be written to the log when you exit the promoted shell. This may be > not quite right - there may have not been enough input to cause a > write flush to the log. >=20 > - The logging seems to be able to see into a spawned subshell, but > I don't think it can see input/output if you, say, kick off an xterm. >=20 What about if you do "sudo vim" and then type ":sh" ? --=20 Devin >=20 >> I've suggested the lrexec module for catching everything, or you can loo= k into the auditdistd (distributed auditing collection/collation to a remot= e/central server) approach, the praudit approach, or any of the other piece= s of software mentions. >>=20 _____________ The information contained in this message is proprietary and/or confidentia= l. If you are not the intended recipient, please: (i) delete the message an= d all copies; (ii) do not disclose, distribute or use the message in any ma= nner; and (iii) notify the sender immediately. In addition, please be aware= that any message addressed to our domain is subject to archiving and revie= w by persons other than the intended recipient. Thank you.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?F8791D4C-8753-469D-8926-3A6B81E7AB51>