On page 69 in the book "Unix and Linux System Administration handbook - Evi Nemeth" under the section 3.2 Management of the root account -> Root account Login, there is a statement that says "To begin with, root logins leave no record of what operations were performed as root.". What does it means to say that "root leaves no record"?
1
-
To be fair, if you are logged into interactive bash shell as root, there may be /root/.bashrc and there is auth log in /var/log when you invoke a command with sudo. But considering that root user can do anything, it can also wipe any log files or history files, which makes it a grand security problem if attacker gains root access ( and by then logs may be the least of your worries anyway )– Sergiy KolodyazhnyyJun 12, 2019 at 6:52
Add a comment
|
1 Answer
There's no log of what commands you ran, what configuration files you edited and so forth by default. There's a log entry for authentication, and end of session, but not what root does.
This is part of the reason for why many sysadmins prefers sudo today; sudo foobar leaves a clear log trail that user x ran command foobar as root on a given time.
sudo also makes it easier to have many administrators on a system, with more fine grained access control than allowed by the single root account.
Note that the above is true for Ubuntu. Debian is somewhat different. RHEL is somewhat more different.
