1

I'm currently (cold) reviewing the sulog of a Solaris box and one of my colleagues asserts that if I see a line that ends in user1-root, therefore user1 has access to the root password.

I suspect that this could actually be the result of user1 calling sudo su root and inputting their own password. I have no live system to test this on, so I'm wondering if someone could confirm my suspicion.

The alternative is that sudo su root will result in a log line ending in root-root.

  • 1
    The su in opensolaris calls cuserid to get the from username, which looks like it'll be the name of the user who first logged in on the tty. – Mark Plotnick Jan 24 '17 at 20:12
2

Which version of Solaris? The reason I ask, is that with v11, root is a role by default. In v11, there is also a feature to allow the user to authenticate to the role with their password to allow for not having a password for the role and/or group account with RBAC ( roleauth=user ). Which means, root might not even have a password to know on Solaris 11.

So the answer depends.

I believe the entry in the sulog would look the same whether they know or don't know the password for the account/role. If you want to know if they called su or sudo, you could ask the user, or check the audit logs. But I'd hope a privileged account was being managed, and that this is an academic type question.

1

On a Solaris 10 test system, I get myuserid-root in the sulog with sudo su root instead of root-root, as I half-expected. Apparently su is capturing SUDO_USER if/when it is set. According to truss, su's environment has both LOGNAME and USER set to root when it goes to write to sulog; SUDO_USER is the only value with myuserid.

  • I would hope su and/or sudo isn't using environment variables as identifying data in log entries. When you run under truss, do you see any possible calls to any name services? Can you run it under dtrace and capture all user-space function calls? – Andrew Henle Jan 25 '17 at 10:27
  • @AndrewHenle I opened up a chat room to go through the truss & dtrace steps, if you're interested. – Jeff Schaller Jan 25 '17 at 19:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.