When a user not in sudoers tries to elevate privileges to root (in Ubuntu 18.04 for example) the OS displays this alert: "Username is not in the sudoers file. This incident will be reported".

Now, where can the admin see this report? How can admins detect an invalid sudo attempt?

I'm specifically interested in CentOS 7.

  • In their email. – Ignacio Vazquez-Abrams Jul 31 '18 at 14:11
  • Hi Ignacio, I tried to check in /var/mail but it's empty – Roberto Jul 31 '18 at 14:12
  • That's not where mail is kept. – Ignacio Vazquez-Abrams Jul 31 '18 at 14:12
  • I don't think so @StephenKitt, I'm asking for a CentOS 7 OS. Meanwhile Ubuntu save this notification into "/var/log/auth.log", I can't find where CentOS save this event. – Roberto Jul 31 '18 at 14:16
  • 1
    Here's the answer: xkcd.com/838 – dr_ Jul 31 '18 at 14:23

On CentOS 7 (since that’s apparently what you’re really interested in), such incidents are reported in the journal; run journalctl -xe as root and you’ll see lines such as

guest : user NOT in sudoers

when a user runs sudo without being allowed to, or

guest : 3 incorrect password attempts

when a user gets their password wrong too many times (with other information as usual in log messages).

Not the answer you're looking for? Browse other questions tagged or ask your own question.