Somewhat OT: Is Full Command Logging Possible?

[John Hein]

Tim Daneliuk wrote at 17:48 -0600 on Dec  5, 2012:
 > On 12/05/2012 05:44 PM, Kurt Buff wrote:
 > > On Wed, Dec 5, 2012 at 3:19 PM, Tim Daneliuk <tundra at tundraware.com> wrote:
 > >> I am working with an institution that today provides limited privilege
 > >> escalation
 > >> on their servers via very specific sudo rules.  The problem is that the
 > >> administrators can do 'sudo su -'.
 > > <snip>
 > >
 > >
 > > sudo is misconfigured.
 > >
 > > man 5 sudoers and man 8 visudo
 > >
 > >
 > >
 > > Kurt
 > >
 >
 > I'm sorry Kurt, I'm sort of dense today, I'm not sure what you're
 > saying.  Are you suggesting that there is a way to configure
 > sudo so that if someone does 'sudo su -' to become an admin,
 > sudo can be made to log every command they execute thereafter?

See log_input and log_output in sudoers(5)