Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

What is the preferred method to keep track of who is acting as root in the logs when root login is disabled (SSH) but users can run sudo -i or su - to become root? I would like to follow every command with the original username as well. RHEL 6 or any Linux rsyslog, etc.

share|improve this question

2 Answers 2

On Red Hat distros you typically use the /var/log/secure log to identify who's been logging in or making use of sudo on a Fedora/CentOS/RHEL system.

Examples

sudo example
$ sudo -Es

log result:

Sep 1 19:32:51 greeneggs sudo: saml : TTY=pts/2 ; PWD=/home/saml ; USER=root ; COMMAND=/bin/bash

su example
$ su -

log result:

Sep 1 19:34:49 greeneggs su: pam_unix(su-l:session): session opened for user root by saml(uid=1000)

share|improve this answer

If you have cooperating users, you can setup rootsh to log everything the root user types to syslog.

http://linux.die.net/man/1/rootsh

rootsh rpms are available in EPEL.

The version of sudo on RHEL6 is also capable of logging stdout to a file for every sudo session. Look into the sudo_plugins man page.

Neither of these approaches is completely bulletproof.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.