When I came on board, all our SAs had to memorize the root password to the systems. I felt that this was cumbersome (when someone separates from the company, we had to touch every server and change password) and insecure.
Finally got enough pull to push personal accounts with
sudo access. I want to have a smooth transition so this is my initial plan:
- Allow SAs to perform "approved" commands without entering passwords.
- Every other command will require password every time you use
sudo. I will audit this command and define them as "approved" if deemed necessary or prevent them from being executed if they pose a security risk.
Our user spec look like this:
%sysadmins ALL = PASSWD: ALL, NOPASSWD: SERVICES, FILE_READING, !/bin/su
Question: How do I have
sudo audit (preferable via e-mail but logs would do) when a command configured with
PASSWD is executed?