Forcing the use of sudo instead of running commands from a terminal as root

Question

I edit my question to give the goal and not an assumption of the solution.

• RHEL based distributions
• The root user is never used and its password is kept secret

All the commands run with sudo are logged under /var/log/secure. When an user switches to root using sudo su/sudo -i, all the commands run under the session aren't logged.

My goal is to keep an eye on what the admins are doing.

---

Example

If an user does:

alexis$ sudo visudo   # this is logged
alexis$ sudo su       # this is logged
root# visudo          # this isn't logged since it's run under root

The command visudo and then su are logged as initiated by the user alexis but with executed with root. Nevertheless all the following commands won't be logged because they are run as root in a root shell.

Nov 1 13:28:29 3020m sudo[6906]: alexis : TTY=pts/0 ; PWD=/home/alexis ; USER=root ; COMMAND=/bin/su

---

In brief, I don't want an user (admin in wheel) to be able to switch to a root shell. If someone wants to run a root shell, he/she has to know the root's password.

Answer 1

It's not possible - please read to the very end. If the user has full sudo access, they can always use sudo -i -u root, sudo /usr/bin/bash, sudo /usr/bin/{ANY_OTHER_SHELL} or write their own script/program that will use a few commands to get to full shell access. It's trivial. They can also revert any configuration changes that you made etc. You might obscure it a little by changing the default root shell to /sbin/nologin.

[vagrant@eurolinux8-vbuilder ~]$ sudo chsh root -s  /sbin/nologin 
Changing shell for root.
chsh: Warning: "/sbin/nologin" is not listed in /etc/shells.
Shell changed.
[vagrant@eurolinux8-vbuilder ~]$ sudo -i
This account is currently not available.

But any power user can use "naked" bash invocation with sudo:

[vagrant@eurolinux8-vbuilder ~]$ sudo /usr/bin/bash
[root@eurolinux8-vbuilder vagrant]# 

So obscuring access with /usr/sbin/nologin is not very potent.

You can also add some script to bash or any other shell configuration to check if the user is root that will print messages like Please use sudo and log out. But once more, power users will be able to use things like --norc and --noprofile or point their own configuration to bash. To sum it up - according to my best knowledge it's not possible. I even check if there are some exceptional cases [for example, with PAM] when using a user that normally is daemon only (like httpd). But with httpd installed you can also use sudo -u apache /usr/bin/bash. Maybe there is some PAM based solution, but with google-fu, I was unable to find them. It's also hard because you are interested in disabling interactive access. In another case (disabling access to root fully), you will brick the system, and you will have to fix it in recovery mode.

But there is a solution that you might be more interested in - terminal logging.

You want to know terminal history, not limit access entirely. In the meantime, you should know that users with full admin access can remove their log - so just in case, you should use rsyslog or other logging solution to put logs to the different server.

Because you are using RHEL based distro - you might read the following. https://www.redhat.com/sysadmin/terminal-logging

Answer 2

Revert the changes to PAM. You don't need them.

Instead, use visudo to edit the file /etc/sudoers and comment out the lines that start with %wheel and/or %sudo. This will stop allowing users who are in those groups from using sudo.

You should add a line for yourself before you write out the changes. Otherwise ensure that you either have a working root password (for su without sudo) or some other means of using sudo to gain root privileges!