I have provided sudo to ten users to become another user like nsup.

I want to track which user executes which command after they become nsup. If there is a way to store the log files in a common file that would be great.

I have tried looking at /var/log/secure, but from there I cannot distinguish which user executed which command after they became nsup. It shows only which user executed the command to become nsup, and nothing beyond that.

  • 2
    That's right, if one uses sudo to open a new shell, actions performed in the shell aren't logged. If there's a way to log them, I don't expect it will be through sudo. And I've never heard of any way to do such logging which aren't "voluntary" (that is, that the user couldn't override). For "voluntary" logging, you could write a script that grabs the latest line from /var/log/secure when a shell starts, and combines that with normal shell history. Or see unix.stackexchange.com/questions/6554/… – dubiousjim Sep 26 '12 at 21:01
  • There could be flaw too. Consider 2 user logged in sametime and they become nzsup user and start exectuing some command.how to find which user executed which command after sudoed to nzsup.all the command executed will be in history file of nzsup only. – Venom Sep 26 '12 at 21:15
  • I was imagining a shell session would just determine at the beginning who the original user was. But yes, there would be a race condition if two users sudoed a new shell right at the same time. The thread I linked to discusses another way to determine who the original user was. – dubiousjim Sep 26 '12 at 23:15

If your users use bash, you can use an /etc/bash.bash_logout script to save an extra copy of the history in time-stamped format.

For example, I wrote the following to provide an audit-trail of who did what and when (on a server with multiple sudo users), and also to preserve history in case the machine was broken into:

#! /bin/bash

# /etc/bash.bash_logout
# Time-stamped bash history logging
# by Craig Sanders <cas@taz.net.au> 2008
# This script is public domain.  Do whatever you want with it.

exec >& /dev/null

# LOGDIR must already exist and must be mode 1777 (same as /tmp)
# put it somewhere easily overlooked by script-kiddies.  /var/log 
# is a bad location because slightly-brighter-than-average SK's will
# often 'rm -rf /var/log' to cover their tracks.

[ -d "$LOGDIR" ] || exit 0

# Get current user name and who they logged in as.
CNAME=$(id -u -n)
LNAME=$(who am i | awk '{print $1}')

# Get the TTY

# get the hostname and ip they logged in from
# short (non-fqdn) hostname:
RHOST_NAME=$(who -m  | awk '{print $5}' | sed -r -e 's/[()]|\..*//g')
# or full hostname:
#RHOST_NAME=$(who -m  | awk '{print $5}' | sed -r -e 's/[()]//g')

# if no RHOST_NAME, then login was on the console.
echo "$RHOST_NAME" | grep -q '[:/]' && RHOST_NAME="console"

# get the IP address
RHOST_IP=$(who -m --ips | awk '{print $5}')
echo "$RHOST_IP" | grep -q '[:/]' && RHOST_IP="console"


WHERE=$(echo "$WHERE" | sed -e 's/\//-/g' -e 's/^-//')

# Filenames will be of the form:
# $LOGDIR/cas--root--localhost--
# Ugly, but useful/informative. This example shows I logged in as cas
# from localhost, sudo-ed to root, and my tty was /dev/pts/1

# Optionally rotate HISTLOG on each logout, otherwise new history
# sessions just get appended.
#[ -e "$HISTLOG" ] && savelog -l -c 21 -q $HISTLOG > /dev/null 2>&1

# Log some easily parseable info as a prelude, including the current
# history settings (an unusual HISTFILE or zero HISTSIZE setting is
# suspicious and worthy of investigation)

cat <<__EOF__ >> "$HISTLOG"

### TIME ### $(date +'%a,%Y-%m-%d,%H:%M:%S')
### WHOM ### $(who -m)


# Setting HISTTIMEFORMAT seems to be buggy. bash man page says it uses
# strftime, but all it seems to care about is whether it's set or not -
# 'history -a' always uses seconds since epoch, regardless of what it is
# set to.

history -a "$HISTLOG"

# Now write history as normal (this seems buggy too. bash used to always
# write $HISTFILE anyway, but now it won't do it if you've already run
# 'history -a')

history -w
  • 1
    Which works unless the user sets HISTFILE=/dev/null... – bahamat Sep 26 '12 at 23:27
  • 1
    it works regardless of what the user sets HISTFILE to. that was the whole point of writing it. read the script, history -a "$HISTLOG" appends the history to $HISTLOG. doesn't use or care about $HISTFILE. – cas Sep 26 '12 at 23:36
  • 1
    alternatively, a much simpler version could be put in user nsup's ~/.bash_logout – cas Sep 26 '12 at 23:52
  • 4
    It should be mentioned that this is obviously not a secure log. Use auditing tools if you want secure logging. – Chris Down Sep 12 '13 at 19:21
  • Re "HISTTIMEFORMAT seems to be buggy" - the format is for presentation, not for storage. It is used when you issue for example history 10. For storage, HISTTIMEFORMAT only says whether to store timestamps (if set to anything) or not to store at all (if unset). The entries are only stored as %s. – kubanczyk Jan 20 '15 at 10:51

I implemented in this way.

in rsylog.conf file I have added the below lines to track

$umask 0000                 
$FileCreateMode 0666         
local2.info /var/log/usercommands
$umask 0077                 

In the /etc/skel/.bashrc file I have added below lines.

enter image description here

Hope this might be helpful

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.