Tell me more ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.
up vote 1 down vote favorite

I'm looking for a good, consistent and easy way to do a report of sudoers permissions for every user and group on the system. For users, I want the report to include permissions granted via group membership.

share|improve this question
2  
Do you mean sudo -l? – jw013 Mar 23 '12 at 14:13
That'd be easy, but sorry... no. It's really reporting on systemwide sudoers for an enterprise environment. At least per system. sudo -l only works for the current user. I'm looking for something reporting for all users on the system and even resolving group permissions down to user level. – pat Mar 23 '12 at 14:15
2  
gawk -F':' '$3 >= 1000{print $1}' /etc/passwd | xargs -I usr sudo -l -U usr – frogstarr78 Mar 24 '12 at 1:20
frogstarr78: thanks, this is pretty good. But still missing resolving the groups. – pat Mar 30 '12 at 15:03
but it at least lists the entitlements... make this an answer and I'll accept it. – pat Mar 30 '12 at 15:10

2 Answers

up vote 1 down vote

Viewing user/group sudo access

You can either 

$ sudo cat /etc/sudoers

or open with the intent of editing

$ sudo visudo

Ubuntu Help

Logs of sudo commands

/var/log/auth.log contains information on when and which commands users execute with sudo privileges.

Start with:

sudo cat /var/log/auth.log
share|improve this answer
sorry, I don't want to report on what users were doing, but what they are entitled to sudo. – pat Mar 30 '12 at 15:04
Oh, alright. I have modified my answer to show you this. – earthmeLon Mar 31 '12 at 8:03
Sorry, I know how to check the sudoers file. This is no reporting though. – pat Apr 4 '12 at 7:47
So, are you asking for a seg/awk script to parse this file and return formatted information? – earthmeLon Apr 4 '12 at 20:33
I was asking for a simple way to do a reporting on this. Check out frogstarr78's comment further above, which is close to what I've been looking for. Only thing missing there is resolving groups.If you take a look at sudoers files in enterprise environments, it's hard to keep track of user rights. So I've been wondering if there is a simple way of achieving reports on sudoers files without too much manual work. – pat Apr 5 '12 at 7:39
show 2 more comments
up vote 0 down vote

Each time sudo is invoked who ran it and for what purpose is logged to a file. This file is different depending on your distribution and /etc/sudoers file. In SLES it is sometimes /var/log/sudo instead of auth.log since by default there is no auth.log

However, you said that you were looking for a consistent and easy way. I would recommend modifying the /etc/sudoers file to log to wherever would be best for you.

logfile is the option you would set. You can read about the options via man sudoers

By, default most distributions log via the syslog facility. However, if it does log to messages or auth.log you have to parse the information out among the rest of the log data. It is easier to use if it goes to it's own file.

share|improve this answer
Thanks, good explaination. But still, this is reporting on what users did, not what they are entitled to. – pat Mar 30 '12 at 15:05

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.