2

I need to log as much as possible when users a doing su *...
Best would be to log all commands especially for the case root does something as a user. We can assume root would not change this logging behaviour.
I think the matching deal would be something like SULOG in debian.
How can I get that running?

Improve this question

1 Answer 1

Reset to default
1

pam_tty_audit(8) was written for exactly this problem:

Examples

Audit all administrative actions.

session

required pam_tty_audit.so disable=* enable=root

You could place this is /etc/pam.d/sudo for auditing only sudo(8), or in /etc/pam.d/common-session if you wanted to audit everything root does at any console.

Improve this answer
2
  • Thanks, sounds fine. I used the common-session way. But - where goes the logging to? And - when beeing root it resulted in two entries in /var/log/messages: changed status from 0 to 1 immediately followed by restored status to 0. Any more hints?
    – Bastian Ebeling
    Commented Jul 11, 2011 at 8:34
  • 1
    @Bastian, no idea on the /var/log/messages entries. The logging will go to your /var/log/audit/audit.log file -- perhaps ausearch(1) can make the logs easier to search or read.
    – sarnold
    Commented Jul 11, 2011 at 21:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .