لطفا منتظر باشید ...
Recipe 5.16 Listing sudo Invocations
5.16.1 Problem
See a report of all unauthorized
sudo attempts.
5.16.2 Solution
Use
logwatch: [Recipe 9.36]
# logwatch --print --service sudo --range all
smith => root
-------------
/usr/bin/passwd root
/bin/rm -f /etc/group
/bin/chmod 4755 /bin/sh
5.16.3 Discussion
If logwatch complains that the script
/etc/log.d/scripts/services/sudo cannot be
found, upgrade logwatch to the latest version.You could also view the log entries directly without
logwatch, extracting the relevant information from
/var/log/secure:
#!/bin/sh
LOGFILE=/var/log/secure
echo 'Unauthorized sudo attempts:'
egrep 'sudo: .* : command not allowed' $LOGFILE | sed 's/^.* sudo: \([^ ][^ ]*\) .* ; USER=\([^ ][^ ]*\) ; COMMAND=\(.*\)$/\1 (\2): \3/'
Output:
Unauthorized sudo attempts:
smith (root): /usr/bin/passwd root
smith (root): /bin/rm -f /etc/group
smith (root): /bin/chmod 4755 /bin/sh
5.16.4 See Also
logwatch(8). The logwatch home page is http://www.logwatch.org.
