0

I have created an auto execute script that will send me an email when the Root Account has been accessed. I, however, would like to further increase the details of that message.

I have several users that have access to my server and would like to monitor the main root account in case something happens I can go to the person and ask what did they do type thing.

Basically, the email would say, "The ROOT account was accessed by [user] at IP Address [ip address] at [hr]:[min] [am/pm]"

Or if that isn't possible I could settle for a user account or an IP address. I'm not picky.

2

/var/log/auth.log contains quite a bit of what you want. For example, escalating to root using sudo -s generated this entry:

Dec 18 19:31:23 kazwolfe sudo:  kazwolfe : TTY=pts/1 ; PWD=/home/kazwolfe ; USER=root ; COMMAND=/bin/bash
Dec 18 19:31:23 kazwolfe sudo: pam_unix(sudo:session): session opened for user root by kazwolfe(uid=0)

From there, I can look at the who command to get the IP address of pts/1:

kazwolfe  pts/1        2017-12-18 19:30 (2001:db8::4665)

That section in parenthesis is my IPv6 address, and can be used as a log entry. You can also see when I loaded my session.

auth.log will also contain other entries for sudo:

Dec 18 19:33:30 kazwolfe sudo:  kazwolfe : TTY=pts/1 ; PWD=/home/kazwolfe ; USER=root ; COMMAND=/bin/cat data
Dec 18 19:33:30 kazwolfe sudo: pam_unix(sudo:session): session opened for user root by kazwolfe(uid=0)
Dec 18 19:33:30 kazwolfe sudo: pam_unix(sudo:session): session closed for user root
Dec 18 19:33:40 kazwolfe sudo:  kazwolfe : TTY=pts/1 ; PWD=/home/kazwolfe ; USER=root ; COMMAND=/usr/bin/tail /var/log/auth.log
Dec 18 19:33:40 kazwolfe sudo: pam_unix(sudo:session): session opened for user root by kazwolfe(uid=0)

As long as you force your admins to go through sudo, you'll have these log entries generated on every escalation. It is, however, important to note that a root user can obscure or otherwise modify these logs to hide things.

If you'd rather not hook to log files, you can set sudo to always send an e-mail (see man sudoers), though be aware that this may generate a lot of useless emails.

If you do this, your email will contain almost the exact same information as listed above. IP addresses will still need to be queried separately, but you can always use the last command to get the last few logins as well.

Admins will need to be very fast to intercept things, so it'll be hard for them to hide damage (though they may delete emails from your inbox if it's on the same server). That said, these logs will still not provide information about what they did inside of a sudo session (especially if they escalated to a command prompt). Solutions for that are far more complicated.

  • Acutally, using this you helped me devise a plan. I am using ssmtp to send emails. I created a script called root_login.sh. Inside I placed in: [echo "The root account has been accessed. Here is the recent login activity" last] I am using .bash_profile I placed bash root_login.sh | ssmtp myemailaddress. The only downside is that it takes about 35 seconds to send but it doesn't display any output and works when the user uses sudo -i. – Harley Frank Dec 19 '17 at 4:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.