Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a user on a Ubuntu system of mine who needs sudo access, but I don't trust him as much as I'd like to be able to. Is there a way to log all of his sudo activity, and email it to me at the end of the day?

share|improve this question

migrated from stackoverflow.com Feb 17 '11 at 19:46

This question came from our site for professional and enthusiast programmers.

1  
Security fail...No trust == no access. –  Robert Harvey Feb 17 '11 at 19:46
1  
You can easily log what he runs with sudo (logged in /var/log/auth.log by default here on Debian), but if he runs sudo bash you won't get to see what he's running in bash. Or sudo vi and using the ! command to get a shell. Or any of the other programs that will open a shell or run commands for the user. –  DerfK Feb 17 '11 at 19:51
    
How much sudo access does he need can you limit it to just a few required commands ? You can also disable commands by prefixing them with a ! –  Iain Feb 17 '11 at 19:53
add comment

3 Answers

up vote 5 down vote accepted

This is not a good idea. There are several weaknesses in this plan.

  1. If you don't trust him, don't give him access. E-Mailing you his evilness at the end of the day won't help anything if he has done it already by evening. And if he really wanted to compromise the system he'd surely find a way to manipulate those pesky emails. It's a pretty easy calculation, if a user you don't trust has administrative privileges on the system you can't trust the systems observation.

  2. If he really needs access, can we work around superuser privileges ? And if he really needs sudo, can it be restricted to just some commands.

share|improve this answer
    
Yeah, you're right. If I don't trust him, he shouldn't have sudo, it's as simple as that. –  zib_redlektab Feb 19 '11 at 6:08
add comment

The simple way to do this is to set up logwatch on your machine. By default logwatch generates an email every night that includes various system details and important log messages. By default it includes all logged sudo commands too.

Then just set the logwatch email address in /etc/logwatch.conf to your address, and you will receive those mails every night.

I strongly advise you to talk to the user in question and share your concerns with him honestly. Much better for him to know that he can ask you if he is confused about anything than for you to find mistakes in the logs. Trust, but verify.

share|improve this answer
add comment

This is the classic example of the concept, Principle of Least Privilege. That is, the user should have the least access necessary to perform their job functions. The real solution to your problem is to implement a standard operating procedure that limits full admin rights to a server to only those people who actually administer the server. While that is easy to suggest, it will take a fair amount of work on your part to implement, and will typically require a change in business process for the DBAs, application admins, etc.

What you need to do is have a sit down with the user and determine exactly what the user does using this system, and map out what access rights that would entail. The really tricky thing here is determining what they need to do as opposed to how they do it. Some of the types of questions you should start with are things like do they need to edit system files, restart services, view log files, etc.

Once you have that information cataloged you can start to figure out if there is anything you should be doing instead. For instance, if a file in /etc/sysconfig need to be changed, should the the user prep the change and then give it to a sysadmin to deploy? Or if they need to be able to manage services, what commands are actually required to do that, and does it have to be done as root or as a service account?

At the end of the exercise you should have a list of commands they need to execute (and as whom), files they'll need to access, and procedures that you and the user can follow for making abnormal changes.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.