2

Assuming that someone used sudo to add a user, is there an easy way to determine who it was?

2 Answers 2

4

Since you mention that they used sudo, you'll likely have this in your logs.

For example, with systemd:

% sudo useradd foobar
% sudo journalctl /bin/sudo | grep -e useradd -e adduser
Dec 18 22:42:37 gongzuo sudo[24430]:    cdown : TTY=pts/10 ; PWD=/home/cdown ; USER=root ; COMMAND=/usr/sbin/useradd foobar

On non-systemd systems, you can typically find this log at /var/log/secure or /var/log/auth.log.

0

As suggested, this varies between systems. It's not the same on Debian, but from testing on Fedora linux:

"The audit subsystem" is installed and enabled by default. You can find out even if the user ran useradd from a root shell opened using sudo -i. If you have a persistent systemd-journal they should appear there, and you can see the numeric User ID which audit holds responsible:

Feb 28 17:30:32 alan-laptop audit[18253]: ADD_GROUP pid=18253 uid=0 auid=1000 ses=9 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=add-group acct="test" exe="/usr/sbin/useradd" hostname=alan-laptop addr=? terminal=pts/1 res=success' Feb 28

17:30:32 alan-laptop audit[18253]: ADD_USER pid=18253 uid=0 auid=1000 ses=9 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=add-user id=1003 exe="/usr/sbin/useradd" hostname=alan-laptop addr=? terminal=pts/1 res=success'

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .