Say you want to be able to easily see who's logged in to a system recently.
auth.log has this information, but it's very cluttered with crontab entries and you have to use sudo to read it.
- Write a script to parse /var/log/auth.log looking for interesting things
- Make root the owner of that script
- Create a user who can't login
- Add that user to the "adm" group, thus giving them read-only access to logfiles
- Put the script in that user's crontab
What are the security risks of that solution? Adding someone to adm group seems risky, but if all they can do is run a script that's been checked to not do anything bad.