sudo-io configuration on Linux

sudo-io is needed to log all sudo commands executed on Linux system with the command input and output stream. This article provides a step by step instruction to configure sudo-io on a Linux system.

Topic

• How to use Linux sudo-io?

• How to configure sudo-io on Linux?

• How to log all sudo command events with command input and output?

• How to use sudoreplay command to play sudo command execution?

• How to rotate sudo-io events?

• sudo-io logrotation

Solution

Add the following configuration to /etc/sudoers file.

Defaults  log_input, log_output

The log_input and log_output parameters tell sudo program to run a command in pseudo-tty and log all user input and all output sent to the screen.

By default sudo-io stores all sudo events in /var/log/sudo-io directory. You can specify a custom directory through the iolog_dir parameter.

sudo-io can store unlimited sudo events if you don’t limit that. A single sudo command stores event in a single directory with 7-8 separate files.

Three sudo commands are stored in 3 separate directory. 
# ls /var/log/sudo-io/00/00/
   01  02  03

Each command stores command output in 7 different files. 
# ls /var/log/sudo-io/00/00/01/|wc -l
7
# ls /var/log/sudo-io/00/00/02/|wc -l
7
# ls /var/log/sudo-io/00/00/03/|wc -l
7

sudo-io rotation

If you don’t limit sudo-io event creation then this will kill all your inode since a single sudo command stores its output in 7-8 files. Add the following configuration to /etc/sudoers file keep last 1000 sudo command history. sudo-io will truncate the oldest command after 1000 numbers have reached.

Defaults  maxseq=1000

If you want to rotate sudo-io events manually, create a shell script which fulfills the following purpose:

• Create a new directory.
• Move all contents from /var/log/sudo-io directory to the new directory and archive the new directory.

Replay sudo-io events

Following are the example of sudoreplay commands to analyze sudo history.

• List all sudo events

# sudoreplay -l 
Apr  1 11:40:11 2020 : test : TTY=/dev/pts/0 ; CWD=/home/test ; USER=root ; TSID=000001 ; COMMAND=/bin/echo My Name 1
Apr  1 11:40:11 2020 : test : TTY=/dev/pts/0 ; CWD=/home/test ; USER=root ; TSID=000002 ; COMMAND=/bin/echo My Name 2
Apr  1 11:40:11 2020 : test : TTY=/dev/pts/0 ; CWD=/home/test ; USER=root ; TSID=000003 ; COMMAND=/bin/echo My Name 3

• List all sudo events of test user.

# sudoreplay -l user test 
Apr  1 11:40:11 2020 : test : TTY=/dev/pts/0 ; CWD=/home/test ; USER=root ; TSID=000001 ; COMMAND=/bin/echo My Name 1
Apr  1 11:40:11 2020 : test : TTY=/dev/pts/0 ; CWD=/home/test ; USER=root ; TSID=000002 ; COMMAND=/bin/echo My Name 2
Apr  1 11:40:11 2020 : test : TTY=/dev/pts/0 ; CWD=/home/test ; USER=root ; TSID=000003 ; COMMAND=/bin/echo My Name 3

• List all echo commands executed by test user account.

# sudoreplay -l user test command echo
Apr  1 11:40:11 2020 : test : TTY=/dev/pts/0 ; CWD=/home/test ; USER=root ; TSID=000001 ; COMMAND=/bin/echo My Name 1
Apr  1 11:40:11 2020 : test : TTY=/dev/pts/0 ; CWD=/home/test ; USER=root ; TSID=000002 ; COMMAND=/bin/echo My Name 2
Apr  1 11:40:11 2020 : test : TTY=/dev/pts/0 ; CWD=/home/test ; USER=root ; TSID=000003 ; COMMAND=/bin/echo My Name 3

• Replay input/output of sudo command with the TSID.

# sudoreplay 000001
Replaying sudo session: /bin/echo My Name 1
My Name 1

• List sudo events from a backup directory

# sudoreplay -d /var/log/sudo-io-bkp -l|head
Apr  1 02:20:19 2020 : test : TTY=/dev/pts/1 ; CWD=/home/test ; USER=root ; TSID=000001 ; COMMAND=/bin/echo My Name 96
Apr  1 02:20:19 2020 : test : TTY=/dev/pts/1 ; CWD=/home/test ; USER=root ; TSID=000002 ; COMMAND=/bin/echo My Name 97