Sudo

From My Admin Page
Jump to: navigation, search

You can download SUDO from the SUDO homepage. There are binaries for most OS's.

Setup logs (Solaris)

You have to add the following line in /etc/syslog.conf:

local2.debug                    /var/log/sudo.log

Then create the logfile: touch /var/log/sudo.log

Finally restart system-log: svcadm restart system-log

Setup logging

With logging you can replay sessions using sudoreplay. From the default /etc/sudoers from version 1.7.8p1, here's how to enable logging:

## Uncomment to enable logging of a command's output, except for
## sudoreplay and reboot.  Use sudoreplay to play back logged sessions.
Defaults log_output
Defaults!/usr/bin/sudoreplay !log_output
Defaults!/usr/local/bin/sudoreplay !log_output
Defaults!/sbin/reboot !log_output

you can list all the sessions using the '-l' flag or search with parameters after the '-l' flag such as:

List sessions run by user millert: sudoreplay -l user millert
List sessions run by user bob with a command containing the string vi: sudoreplay -l user bob command vi
List sessions run by user jeff that match a regular expression: sudoreplay -l user jeff command '/bin/[a-z]*sh'
List sessions run by jeff or bob on the console: sudoreplay -l ( user jeff or user bob ) tty console