1

I working in an environment with multiple users who can invoke sudo with their own passwords.
Most users login via ssh, call sudo -i and do "work".
The problem is when it comes to identify WHO did something that broke working service/script.

Is there a way to preserve separate cmd history? Right now I have to su root and call history which:

  1. wont show me all called commands - because multiple root sessions will overwrite bash history.
  2. I dont know who called which command as root

I know that each user could skip sudo -i and call each command sudo <cmd> and that would be saved in each users bash history, but I wont be able to "force" that with words(only with configuration)

Improve this question
5
  • 2
    Maybe unix.stackexchange.com/questions/596722/…
    – Marc Wilson
    Jun 17, 2021 at 18:40
  • Do you have multiple users who effectively have full root capabilities? It is possible to restrict different users to have access to different subsets of root capabilities.
    – Jeremy Boden
    Jun 17, 2021 at 19:44
  • @JeremyBoden I have multiple users with admin privileges(I am one of them). The fact that every admin have full access is not a problem(due to the way we work) but I would like to make sure that we can pretty much blame single person if something goes wrong or if someone's account is breached it would be easier to identify who was "hacked".
    – Iluvatar
    Jun 17, 2021 at 19:56
  • "if someone's account is breached it would be easier to identify who was "hacked"" not at all. If the root account is breached then you can't trust any log file written and stored locally
    – Chris Davies
    Jun 17, 2021 at 19:58
  • "Pride comes before a fall".
    – Jeremy Boden
    Jun 17, 2021 at 20:01

1 Answer 1

Reset to default
0

visudo

Include a line:-

Defaults logfile=/var/log/sudo (or similar)

Note:- You need to be root to read the log. Example:-

Jun 17 20:56:26 : jeremy : TTY=pts/0 ; PWD=/home/jeremy ; USER=root ;
    COMMAND=/usr/bin/ls -lh
Improve this answer
3
  • Any user with full sudo access can presumably adjust this log.
    – Jeremy Boden
    Jun 17, 2021 at 20:04
  • If I do sudo -i (I have pointed that this is most common case), it wont show any later command in log
    – Iluvatar
    Jun 17, 2021 at 20:33
  • 1
    sudo -i is equivalent to sudo /bin/bash - you might as well give everyone a card with the root password printed in very large characters.
    – Jeremy Boden
    Jun 17, 2021 at 21:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .