I am the owner of a company. I want to keep an audit trail of our Unix administrator who has root access to the CentOS system. How can I configure it such that the audit trail cannot be bypassed and erased even for Root user?
Thanks in advance!
Server Fault is a question and answer site for system and network administrators. It only takes a minute to sign up.Sign up to join this community
I don't think you can do this effectively if you don't trust your sysadmin. Root user can do anything on the system.
You can disable root access and enable auditing for all
sudo actions. However, any sysadmin (has
sudo privilege) can know how to disable it. If you can assign specific privileges for specific people that will be better. The less privilege you give to people (whenever possible), the higher security you get.