2

I edit my question to give the goal and not an assumption of the solution.

  • RHEL based distributions
  • The root user is never used and its password is kept secret

All the commands run with sudo are logged under /var/log/secure. When an user switches to root using sudo su/sudo -i, all the commands run under the session aren't logged.

My goal is to keep an eye on what the admins are doing.


Example

If an user does:

alexis$ sudo visudo   # this is logged
alexis$ sudo su       # this is logged
root# visudo          # this isn't logged since it's run under root

The command visudo and then su are logged as initiated by the user alexis but with executed with root. Nevertheless all the following commands won't be logged because they are run as root in a root shell.

Nov 1 13:28:29 3020m sudo[6906]: alexis : TTY=pts/0 ; PWD=/home/alexis ; USER=root ; COMMAND=/bin/su


In brief, I don't want an user (admin in wheel) to be able to switch to a root shell. If someone wants to run a root shell, he/she has to know the root's password.

7
  • For logging concerns, see this QA: unix.stackexchange.com/q/108577/173368
    – Haxiel
    Nov 1, 2021 at 11:19
  • 1
    Can't be done. If you don't trust the users to do the right thing, don't give them sudo.
    – doneal24
    Nov 1, 2021 at 11:20
  • 1
    Why is sudo su relevant? That's never particularly useful, either your users have the root password and can run su directly or they don't and they can do sudo -i. Also, what operating system is this? That's an important detail. Please edit your question, tell us your OS and clarify if the system has an activated root account and whether your users have the root password. Is removing sudo and sticking with su and then giving the root password only to those users in your target group an option?
    – terdon
    Nov 1, 2021 at 11:37
  • The problem is that your sudo su is pointless. I know that Ubuntu users praise it, but it's still pointless. Your sudo command gets root for the current user (and it's this that you need to address), and then it asks su, which is now already root, to become root. Much easier and clearer to use sudo -s and avoid doubling up with su at all Nov 1, 2021 at 12:19

2 Answers 2

1

It's not possible - please read to the very end. If the user has full sudo access, they can always use sudo -i -u root, sudo /usr/bin/bash, sudo /usr/bin/{ANY_OTHER_SHELL} or write their own script/program that will use a few commands to get to full shell access. It's trivial. They can also revert any configuration changes that you made etc. You might obscure it a little by changing the default root shell to /sbin/nologin.

[vagrant@eurolinux8-vbuilder ~]$ sudo chsh root -s  /sbin/nologin 
Changing shell for root.
chsh: Warning: "/sbin/nologin" is not listed in /etc/shells.
Shell changed.
[vagrant@eurolinux8-vbuilder ~]$ sudo -i
This account is currently not available.

But any power user can use "naked" bash invocation with sudo:

[vagrant@eurolinux8-vbuilder ~]$ sudo /usr/bin/bash
[root@eurolinux8-vbuilder vagrant]# 

So obscuring access with /usr/sbin/nologin is not very potent.

You can also add some script to bash or any other shell configuration to check if the user is root that will print messages like Please use sudo and log out. But once more, power users will be able to use things like --norc and --noprofile or point their own configuration to bash. To sum it up - according to my best knowledge it's not possible. I even check if there are some exceptional cases [for example, with PAM] when using a user that normally is daemon only (like httpd). But with httpd installed you can also use sudo -u apache /usr/bin/bash. Maybe there is some PAM based solution, but with google-fu, I was unable to find them. It's also hard because you are interested in disabling interactive access. In another case (disabling access to root fully), you will brick the system, and you will have to fix it in recovery mode.

But there is a solution that you might be more interested in - terminal logging.

You want to know terminal history, not limit access entirely. In the meantime, you should know that users with full admin access can remove their log - so just in case, you should use rsyslog or other logging solution to put logs to the different server.

Because you are using RHEL based distro - you might read the following. https://www.redhat.com/sysadmin/terminal-logging

1
  • So sad it isn't possible. I don't trust the user (my boss thinks he knows..) but I also know his lack of skills and he does things he doesn't understand. I still want to know what he does, if he intentionally removes his logs, that's different. Thanks!
    – Alexis
    Nov 1, 2021 at 13:37
0

Revert the changes to PAM. You don't need them.

Instead, use visudo to edit the file /etc/sudoers and comment out the lines that start with %wheel and/or %sudo. This will stop allowing users who are in those groups from using sudo.

You should add a line for yourself before you write out the changes. Otherwise ensure that you either have a working root password (for su without sudo) or some other means of using sudo to gain root privileges!

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .