Somewhat OT: Is Full Command Logging Possible?

[Tim Daneliuk]

On 12/05/2012 05:44 PM, Kurt Buff wrote:
> On Wed, Dec 5, 2012 at 3:19 PM, Tim Daneliuk <tundra at tundraware.com> wrote:
>> I am working with an institution that today provides limited privilege
>> escalation
>> on their servers via very specific sudo rules.  The problem is that the
>> administrators can do 'sudo su -'.
> <snip>
>
>
> sudo is misconfigured.
>
> man 5 sudoers and man 8 visudo
>
>
>
> Kurt
>

I'm sorry Kurt, I'm sort of dense today, I'm not sure what you're
saying.  Are you suggesting that there is a way to configure
sudo so that if someone does 'sudo su -' to become an admin,
sudo can be made to log every command they execute thereafter?

-- 
----------------------------------------------------------------------------
Tim Daneliuk     tundra at tundraware.com
PGP Key:         http://www.tundraware.com/PGP/