The administrator(s) of a system are likely to want to know when a non-privileged user tries but fails to execute commands using
sudo. If this happens, it could be a sign of
- a curious legitimate user just trying things out, or
- a hacker trying to do "bad things".
sudo by itself can not distinguish between these, failed attempts to use
sudo are brought to the attention of the admins.
Depending on how
sudo is configured on your system, any attempt (successful or not) to use
sudo will be logged. Successful attempts are logged for audit purposes (to be able to keep track of who did what when), and failed attempts for security.
On a fairly vanilla Ubuntu setup that I have, this is logged in
If a user gives the wrong password three times, or if they are not in the
sudoers file, an email is sent to root (depending on the configuration of
sudo, see below). This is what's meant by "this incident will be reported".
The email will have a prominent subject:
Subject: *** SECURITY information for thehostname ***
The body of the message contains the relevant lines from the logfile, for example
thehostname : Jun 22 07:07:44 : nobody : user NOT in sudoers ; TTY=console ; PWD=/some/path ; USER=root ; COMMAND=/bin/ls
(Here, the user
nobody tried to run
sudo as root, but failed since they were not in the
No email is sent if (local) mail has not been set up on the system.
All of these things are configurable as well, and that local variations in the default configuration may differ between Unix variants.
Have a look at the
mail_no_user setting (and related
mail_* settings) in the
sudoers manual (my emphasis below):
If set, mail will be sent to the mailto user if the invoking user is not in the
sudoers file. This flag is on by default.