1

I have a LDAP user named "ciadmin" created on the Red Hat based system without sudo privlidges. Somehow this user now has sudo privileges and can basically become root on the system.

I want to track how did that happen and who did it ?

I noticed in visudo user ciadmin is present as below. Looks like someone tampered the file but not sure who yet

## Read drop-in files from /etc/sudoers.d (the # here does not mean a comment)
#includedir /etc/sudoers.d
ciadmin ALL=(ALL)       NOPASSWD:ALL
  • ciadmin should be added to group sudo. login as ciadmin (by su ciadmin) and post output of groups – Pandya Dec 18 '15 at 13:02
  • You can also check for group membership using id -a ciadmin and getent group|grep ciadmin. Perhaps a group called sudo, wheel, admin or something like it matches. – Lambert Dec 18 '15 at 13:09
  • Check the last modification date of the /etc/sudoers file and compare the timestamp with the output of last. – Lambert Dec 18 '15 at 13:13
  • And, the group check is still valid. User ciadmin might had sudo permissions to be used with a password and added him/herself to the /etc/sudoers file. – Lambert Dec 18 '15 at 13:16
  • And you might try egrep "visudo|sudoers" /home/*/.* to search for the visudo and sudoers in shell history files on the host. – Lambert Dec 18 '15 at 13:17
0

You can find relevant history at /var/log/auth.log old files are stored as compressed in .gz . It Contains system authorization information, including user logins and authentication mechanism that were used.

You can find out file as follows:

$ ls /var/log | grep -i auth
auth.log
auth.log.1
auth.log.2.gz
auth.log.3.gz
auth.log.4.gz

Example: I've just created user xyz and then added to group sudo and the relevant history can be found by:

$ cat /var/log/auth.log | grep -i xyz
Dec 18 18:54:51 pandya-desktop sudo:   pandya : TTY=pts/2 ; PWD=/home/pandya ; USER=root ; COMMAND=/usr/sbin/useradd xyz
Dec 18 18:54:51 pandya-desktop useradd[7763]: new group: name=xyz, GID=1002
Dec 18 18:54:51 pandya-desktop useradd[7763]: new user: name=xyz, UID=1002, GID=1002, home=/home/xyz, shell=
Dec 18 18:55:51 pandya-desktop sudo:   pandya : TTY=pts/2 ; PWD=/home/pandya ; USER=root ; COMMAND=/usr/sbin/usermod -a -G group xyz
Dec 18 18:55:57 pandya-desktop sudo:   pandya : TTY=pts/2 ; PWD=/home/pandya ; USER=root ; COMMAND=/usr/sbin/usermod -a -G sudo xyz
Dec 18 18:55:57 pandya-desktop usermod[7872]: add 'xyz' to group 'sudo'
Dec 18 18:55:57 pandya-desktop usermod[7872]: add 'xyz' to shadow group 'sudo'

You can see line Dec 18 18:55:57 pandya-desktop usermod[7872]: add 'xyz' to group 'sudo' so, It gives the history that at Dec 18 18:55:57, the user xyz is added tp group sudo

  • 1
    The auth log records sudo usage and authentication usage, not necessarily changes to /etc/sudoers. It might help though to see if a user used sudo visudo for instance. It does not record if someone used su -c visudo for instance. – Lambert Dec 18 '15 at 13:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.