How to log all sudo commands :

Sometimes it’s necessary to log all the sudo commands run in your environment.

Let”s see how to achieve this.

Edit the sudoers file by running visudo
visudo
Add the below line to the Defaults section
Defaults logfile=/var/log/sudo

Now all the commands from a sudo user will be logged in /var/log/sudo file.
[root@awsadminz ~]# cat /var/log/sudo
Jan 11 09:40:49 : user1 : TTY=pts/0 ; PWD=/home/user1 ; USER=root ;
COMMAND=/bin/su –
Jan 11 09:41:56 : user1 : TTY=pts/0 ; PWD=/home/user1 ; USER=root ;
COMMAND=/bin/ls /var/www/html
Jan 11 09:42:08 : user1 : TTY=pts/0 ; PWD=/home/user1 ; USER=root ;
COMMAND=/bin/cat /etc/passwd
Jan 11 09:42:47 : user1 : TTY=pts/0 ; PWD=/home/user1 ; USER=root ;
COMMAND=/bin/su –

Works on: CentOS, RHEL 5/6/7 Ubuntu, Any Linux flavors

Source : https://nixhive.com/log-sudo-commands/

 

 

Posted on: May 22, 2022, by : Julian's | 42 views