Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I would like to do a few things. I would like to have a sudoers file that gives access to all commands except for "sudo su -" and also "sudo rm {anything in var log}". The second one is purely so someone can't delete what they have been doing. This way I have history of all the commands the admins run as root.....with a timestamp would even be better if possible?

Then, we run our servers with a user called serveruser. I would prefer that any commands someone wants to run as that user also has to do something like sudo every time and we log every command as the user that actually ran the command. I do NOT want someone doing "sudo su - serveruser" and then running commands as I have no access to who ran the commands.

How does one go about locking down a server so I can see all this information and have traceability. We just want the ability to see what was being done to a system when it goes bad such that we can possibly reverse the mistake and talk to the person that was doing the work as well.

thanks, Dean

share|improve this question
1  
deleting anything in /var/log shouldn't be an issue, because the logs will also be on your central logging host (if that's not the case, it should be). –  Sirex Dec 20 '12 at 21:04
    
nope, no central logging so still a desire to do that. –  Dean Hiller Dec 20 '12 at 21:06
2  
ok, but bear in mind giving people any root level access to the system and not backing the log files up remotely is asking for trouble. For example, sudo vim , then :!rm /var/log/<file> –  Sirex Dec 20 '12 at 21:08
add comment

2 Answers

Short answer: YOU CAN NOT DO THAT (in any feasible way that is) using nothing by sudo If you take away sudo su - functionality, then you have to specify what they can run individually. And what I heard through the grapevine, sudo is not bullet-proof. You can fool it and make it do things that administrators are trying to prevent you from doing.

What you need is an auditing system and it needs to log to a remote host, which is not accessible with the root privileges from your local server. Otherwise, you are giving the keys for the kingdom to the people you (obviously) don't trust and hoping for the best.

If this is a workplace requirement, I'd strongly suggest spending the money and getting PowerBroker from Beyond Trust (formerly known as Symark). It ain't cheap but it does what you need:dishing out granular privileges and logging them.

share|improve this answer
    
eh, I don't need it to be that secure. If we grow we can add it. Right now we want it more for auditing to see what people did if something goes wrong. –  Dean Hiller Dec 21 '12 at 12:12
add comment
up vote 1 down vote accepted

I found there are some decent things out there like rootsh and other ones as well that it might be possible to write a short script. It is not 100% secure but I don't need that...if one of our admins wanted to destroy our system, they could anyways....we all just want the traceability so our admins might start running "fakesudo.sh user" which gets the job done for us.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.