[ale] Auditing root shells

[James P. Kinney III]

Chris,

Serial console is an excellent idea. I now recall from "The Cuckoos Egg"
the use of a serial console split on the wire to a line printer that was
used to capture the command during a breaking.

the tool sudosh (sourceforge) is a one-stop-shop for what is needed
here. It is shell agnostic and acts basically like a keystroke logger.
Admins ( even the whiney "sudo is too hard" ones) can access it with
"sudo sudosh" (make it the _only_ thing they can access by aliasing sudo
to it or setting it as the only allowed shell in /etc/shells).

It also has the sudosh-replay which allows a one to pick the admin and
replay their commands. Couple this with syslog being tee'ed to a remote
machine that is append only.

On Mon, 2005-09-19 at 09:53 -0400, Christopher Fowler wrote:
> On Mon, 2005-09-19 at 09:01 -0400, John Wells wrote:
> > We have a need to capture everything an admin does while logged in as
> > root
> > and another power login (postgres).  This is driven by a number of
> > forces,
> > not the least of which is Sarbanes Oxley.
> 
> There is the solution of using a serial console only as root and the
> serial console can log all console output to a separate server.
> Consider this screen capture of the console.
> 
> 
> _______________________________________________
> Ale mailing list
> Ale at ale.org
> http://www.ale.org/mailman/listinfo/ale
-- 
James P. Kinney III          \Changing the mobile computing world/
CEO & Director of Engineering \          one Linux user         /
Local Net Solutions,LLC        \           at a time.          /
770-493-8244                    \.___________________________./
http://www.localnetsolutions.com

GPG ID: 829C6CA7 James P. Kinney III (M.S. Physics)
<jkinney at localnetsolutions.com>
Fingerprint = 3C9E 6366 54FC A3FE BA4D 0659 6190 ADC3 829C 6CA7
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part