I would like to do a few things. I would like to have a sudoers file that gives access to all commands except for "sudo su -" and also "sudo rm {anything in var log}". The second one is purely so someone can't delete what they have been doing. This way I have history of all the commands the admins run as root.....with a timestamp would even be better if possible?
Then, we run our servers with a user called serveruser. I would prefer that any commands someone wants to run as that user also has to do something like sudo every time and we log every command as the user that actually ran the command. I do NOT want someone doing "sudo su - serveruser" and then running commands as I have no access to who ran the commands.
How does one go about locking down a server so I can see all this information and have traceability. We just want the ability to see what was being done to a system when it goes bad such that we can possibly reverse the mistake and talk to the person that was doing the work as well.
thanks, Dean