sudo-io configuration on Linux

Linux sudo-io

sudo-io is needed to log all sudo commands executed on Linux system with the command input and output stream. This article provides a step by step instruction to configure sudo-io on a Linux system.


Topic

  • How to use Linux sudo-io?
  • How to configure sudo-io on Linux?
  • How to log all sudo command events with command input and output?
  • How to use sudoreplay command to play sudo command execution?
  • How to rotate sudo-io events?
  • sudo-io logrotation


Solution


Add the following configuration to /etc/sudoers file.

Defaults  log_input, log_output

The log_input and log_output parameters tell sudo program to run a command in pseudo-tty and log all user input and all output sent to the screen.

By default sudo-io stores all sudo events in /var/log/sudo-io directory. You can specify a custom directory through the iolog_dir parameter.

sudo-io can store unlimited sudo events if you don’t limit that. A single sudo command stores event in a single directory with 7-8 separate files.

Three sudo commands are stored in 3 separate directory. 
# ls /var/log/sudo-io/00/00/
   01  02  03

Each command stores command output in 7 different files. 
# ls /var/log/sudo-io/00/00/01/|wc -l
7
# ls /var/log/sudo-io/00/00/02/|wc -l
7
# ls /var/log/sudo-io/00/00/03/|wc -l
7

sudo-io rotation

If you don’t limit sudo-io event creation then this will kill all your inode since a single sudo command stores its output in 7-8 files. Add the following configuration to /etc/sudoers file keep last 1000 sudo command history. sudo-io will truncate the oldest command after 1000 numbers have reached.

Defaults  maxseq=1000

If you want to rotate sudo-io events manually, create a shell script which fulfills the following purpose:

  • Create a new directory.
  • Move all contents from /var/log/sudo-io directory to the new directory and archive the new directory.


Replay sudo-io events

Following are the example of sudoreplay commands to analyze sudo history.

  • List all sudo events
# sudoreplay -l 
Apr  1 11:40:11 2020 : test : TTY=/dev/pts/0 ; CWD=/home/test ; USER=root ; TSID=000001 ; COMMAND=/bin/echo My Name 1
Apr  1 11:40:11 2020 : test : TTY=/dev/pts/0 ; CWD=/home/test ; USER=root ; TSID=000002 ; COMMAND=/bin/echo My Name 2
Apr  1 11:40:11 2020 : test : TTY=/dev/pts/0 ; CWD=/home/test ; USER=root ; TSID=000003 ; COMMAND=/bin/echo My Name 3

  • List all sudo events of test user.
# sudoreplay -l user test 
Apr  1 11:40:11 2020 : test : TTY=/dev/pts/0 ; CWD=/home/test ; USER=root ; TSID=000001 ; COMMAND=/bin/echo My Name 1
Apr  1 11:40:11 2020 : test : TTY=/dev/pts/0 ; CWD=/home/test ; USER=root ; TSID=000002 ; COMMAND=/bin/echo My Name 2
Apr  1 11:40:11 2020 : test : TTY=/dev/pts/0 ; CWD=/home/test ; USER=root ; TSID=000003 ; COMMAND=/bin/echo My Name 3

  • List all echo commands executed by test user account.
# sudoreplay -l user test command echo
Apr  1 11:40:11 2020 : test : TTY=/dev/pts/0 ; CWD=/home/test ; USER=root ; TSID=000001 ; COMMAND=/bin/echo My Name 1
Apr  1 11:40:11 2020 : test : TTY=/dev/pts/0 ; CWD=/home/test ; USER=root ; TSID=000002 ; COMMAND=/bin/echo My Name 2
Apr  1 11:40:11 2020 : test : TTY=/dev/pts/0 ; CWD=/home/test ; USER=root ; TSID=000003 ; COMMAND=/bin/echo My Name 3

  • Replay input/output of sudo command with the TSID.
# sudoreplay 000001
Replaying sudo session: /bin/echo My Name 1
My Name 1

  • List sudo events from a backup directory
# sudoreplay -d /var/log/sudo-io-bkp -l|head
Apr  1 02:20:19 2020 : test : TTY=/dev/pts/1 ; CWD=/home/test ; USER=root ; TSID=000001 ; COMMAND=/bin/echo My Name 96
Apr  1 02:20:19 2020 : test : TTY=/dev/pts/1 ; CWD=/home/test ; USER=root ; TSID=000002 ; COMMAND=/bin/echo My Name 97


You May Also Like

avatar

About the Author: TekFik

TekFik is a technical blogging site helps techies and engineers to solve their day to day issues and also allows everyone to share knowledge and feedback. Please feel free to contact us at tekfik.rd@gmail.com if there is anything.

Leave a Reply

Your email address will not be published. Required fields are marked *