Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

When I came on board, all our SAs had to memorize the root password to the systems. I felt that this was cumbersome (when someone separates from the company, we had to touch every server and change password) and insecure.

Finally got enough pull to push personal accounts with sudo access. I want to have a smooth transition so this is my initial plan:

  1. Allow SAs to perform "approved" commands without entering passwords.
  2. Every other command will require password every time you use sudo. I will audit this command and define them as "approved" if deemed necessary or prevent them from being executed if they pose a security risk.

Our user spec look like this:

%sysadmins      ALL =  PASSWD: ALL, NOPASSWD: SERVICES, FILE_READING, !/bin/su

Question: How do I have sudo audit (preferable via e-mail but logs would do) when a command configured with PASSWD is executed?

share|improve this question
    
You may want to consider centralized log reporting and using a tool like Logstash or Splunk. Makes trapping these events easier and centralizes the alerting/audit aspect. Worth doing if you have a growing number of end points to monitor. –  jeffatrackaid Dec 28 '11 at 19:25
add comment

3 Answers

up vote 11 down vote accepted

Every time sudo is invoked, it logs the command executed to syslog, so I'd recommend just installing logwatch. By default, it comes with filters/aggregators for parsing out sudo entries, and it can email you daily reports.

You may need to write a custom logwatch filter to differentiate between your two different sets of commands.

If you need instant notification of sudo commands, you can use the mail output module with rsyslog. You will need to apply filters so that only sudo messages get sent to this module, lest you wake up in the morning with 10k messages in your inbox.

share|improve this answer
    
for further auditing, also take a look at: linux.die.net/man/8/auditd –  JMW Dec 28 '11 at 11:26
add comment

Like ErikA said, sudo will already log everything that is run. You could also install Splunk and (if using the paid version) have an alert that emails you whenever it sees a sudo message. This alone probably isn't worth the license, but if you've already got one, or have been thinking about it, this would be easily taken care of.

share|improve this answer
add comment

Typically all these events are logged into "/var/log/auth.log"

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.