sudo

sudo

Securing Sudo

In this tutorial we will secure Sudo by enabling logging. Giving us the ability to replay a users session. Prerequisites I will be using Ubuntu however this should work on most systems with sudo. Keep in mind the paths and files may differ across different systems. Enable SUDO Logging There

sudo

Sudo Logging and Monitoring

For Debian based systems Basic Logging methods Log what sudo did (/var/log/auth.log) Debugging (/var/log/sudo_debug) Full session capture (/var/log/sudo-io) With these three you can customize the level of logging needed for your environment. VISUDO You should always use visudo to edit the /etc/