Recipe 5.16 Listing sudo Invocations

5.16.1 Problem

See a report of all unauthorized sudo attempts.

5.16.2 Solution

Use logwatch: [Recipe 9.36]

# logwatch --print --service sudo --range all smith => root ------------- /usr/bin/passwd root /bin/rm -f /etc/group /bin/chmod 4755 /bin/sh

5.16.3 Discussion

If logwatch complains that the script /etc/log.d/scripts/services/sudo cannot be found, upgrade logwatch to the latest version.

You could also view the log entries directly without logwatch, extracting the relevant information from /var/log/secure:

#!/bin/sh LOGFILE=/var/log/secure echo 'Unauthorized sudo attempts:' egrep 'sudo: .* : command not allowed' $LOGFILE \      | sed 's/^.* sudo: \([^ ][^ ]*\) .* ; USER=\([^ ][^ ]*\) ; COMMAND=\(.*\)$/\1 (\2): \3/'

Output:

Unauthorized sudo attempts: smith (root): /usr/bin/passwd root smith (root): /bin/rm -f /etc/group smith (root): /bin/chmod 4755 /bin/sh

5.16.4 See Also

logwatch(8). The logwatch home page is http://www.logwatch.org.