Somewhat OT: Is Full Command Logging Possible?

[Tim Daneliuk]

On 12/18/2012 07:09 PM, Tim Daneliuk wrote:
> On 12/18/2012 06:53 PM, John Hein wrote:
>> Tim Daneliuk wrote at 17:48 -0600 on Dec  5, 2012:
>>   > On 12/05/2012 05:44 PM, Kurt Buff wrote:
>>   > > On Wed, Dec 5, 2012 at 3:19 PM, Tim Daneliuk <tundra at tundraware.com> wrote:
>>   > >> I am working with an institution that today provides limited privilege
>>   > >> escalation
>>   > >> on their servers via very specific sudo rules.  The problem is that the
>>   > >> administrators can do 'sudo su -'.
>>   > > <snip>
>>   > >
>>   > >
>>   > > sudo is misconfigured.
>>   > >
>>   > > man 5 sudoers and man 8 visudo
>>   > >
>>   > >
>>   > >
>>   > > Kurt
>>   > >
>>   >
>>   > I'm sorry Kurt, I'm sort of dense today, I'm not sure what you're
>>   > saying.  Are you suggesting that there is a way to configure
>>   > sudo so that if someone does 'sudo su -' to become an admin,
>>   > sudo can be made to log every command they execute thereafter?
>>
>> See log_input and log_output in sudoers(5)
>
> Thanks so much John, that's the secret sauce I was looking for...
>
>

One further question, if I may.  If I do this:

    sudo su -

Will log_input record everything I do once I've been promoted to
root?  I ask because my initial experiments seem to show that all
that's getting recorded is the content of the sudo command itself,
not the subsequent actions...

-- 
----------------------------------------------------------------------------
Tim Daneliuk     tundra at tundraware.com
PGP Key:         http://www.tundraware.com/PGP/