Somewhat OT: Is Full Command Logging Possible?
Tim Daneliuk
tundra at tundraware.com
Wed Dec 19 01:43:42 UTC 2012
On 12/18/2012 07:33 PM, Devin Teske wrote:
>
> On Dec 18, 2012, at 5:18 PM, Tim Daneliuk wrote:
>
>>>
>>
>> One further question, if I may. If I do this:
>>
>> sudo su -
>>
>> Will log_input record everything I do once I've been promoted to
>> root? I ask because my initial experiments seem to show that all
>> that's getting recorded is the content of the sudo command itself,
>> not the subsequent actions…
>>
>
> Correct, sudo is blind to the actions performed once the command requested is executed (in this case, "su" and subsequently a shell followed by more actions).
>
Actually, I just tried this with both log_input and log_output options enabled.
It seems that it *can* see into the promoted shell with a few caveats:
- Command output is logged immediately, but command inputs appear to only
be written to the log when you exit the promoted shell. This may be
not quite right - there may have not been enough input to cause a
write flush to the log.
- The logging seems to be able to see into a spawned subshell, but
I don't think it can see input/output if you, say, kick off an xterm.
> I've suggested the lrexec module for catching everything, or you can look into the auditdistd (distributed auditing collection/collation to a remote/central server) approach, the praudit approach, or any of the other pieces of software mentions.
>
--
----------------------------------------------------------------------------
Tim Daneliuk tundra at tundraware.com
PGP Key: http://www.tundraware.com/PGP/
More information about the freebsd-questions
mailing list