Tell me more ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.
up vote 2 down vote favorite

I need to log as much as possible when users a doing su *...
Best would be to log all commands especially for the case root does something as a user. We can assume root would not change this logging behaviour.
I think the matching deal would be something like SULOG in debian.
How can I get that running?

share|improve this question

1 Answer

up vote 1 down vote

pam_tty_audit(8) was written for exactly this problem:

Examples

Audit all administrative actions.

session

required pam_tty_audit.so disable=* enable=root

You could place this is /etc/pam.d/sudo for auditing only sudo(8), or in /etc/pam.d/common-session if you wanted to audit everything root does at any console.

share|improve this answer
Thanks, sounds fine. I used the common-session way. But - where goes the logging to? And - when beeing root it resulted in two entries in /var/log/messages: changed status from 0 to 1 immediately followed by restored status to 0. Any more hints? – Bastian Ebeling Jul 11 '11 at 8:34
1  
@Bastian, no idea on the /var/log/messages entries. The logging will go to your /var/log/audit/audit.log file -- perhaps ausearch(1) can make the logs easier to search or read. – sarnold Jul 11 '11 at 21:45

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.