Single Machine sudo log audit

#####################################################

This article is from "Old boy Linux operation and maintenance training" students-xudong he

If reproduced, please be sure to keep this article link and this content copyright information.

Welcome to the vast number of operations and colleagues to Exchange Linux/unix website operation and Maintenance technology!

qq:345078833

E-mail:[email protected]

#####################################################

Old boy Linux OPS training Center

Training consultation: qq:80042789 70271111

Training Tel: 18600338340 18911718229

Old boy teacher qq:49000448 31333741

Website address: http://www.etiantian.org

Old boy Blog: http://oldboy.blog.51cto.com

old boy Exchange Group 246054962 208160987 226199307 44246017

Website operation and Maintenance Exchange Group: 114580181 45039636 37081784
#####################################################

R Pm–qa | egrep "Sudo|rsyslog"

Yum–y Install sudo syslog

echo "Defaults Logfile=/var/log/sudo.log" >>/etc/sudoers

Tail-l/etc/sudoers

Visudo-c #检查sudoers文件语法

echo "Local2.debug/var/log/sudo.log" >>/etc/rsyslog.conf

Restart Syslog Kernel Logger

/etc/init.d/rsyslog restart

You can use the normal user sudo test to see if sudo has log printing.

Ll/var/log/sudo.log

600 permissions

Sudo-l to view your permissions.

Test:

Create a normal user and grant sudo permission to the user. Whether the test was successful. If unsuccessful: Check that the sudo-c syntax is correct.

This article from the "Clear Sky" blog, declined reprint!

Single Machine sudo log audit