7 of 12
added 18 characters in body
pa4080
  • 29.9k
  • 10
  • 89
  • 162

I assume the root account is not enabled (as it is by default), so only sudo -i is applicable for a user to become root. My suggestion is the following script that uses the commands who -u and pgrep -at <tty parsed from who -u> (the rest of it is formatting of the output) to find which user on which tty is executed the command sudo -i.

#!/bin/bash
LANG=C
main(){
        who -u | while IFS= read -r line; do
                USR="$(echo $line | awk '{print $1}')"
                TTY="$(echo $line | awk '{print $2}')"
                PID="$(echo $line | awk '{print $6}')"
                TIME="$(echo $line | awk '{print $4}')"
                IS_ROOT="$(pgrep -at $TTY | grep 'sudo -i')"
                [[ ! -z "${IS_ROOT}" ]] && printf '%-7s ( PID %-6s at %s on TTY %-7s) is ROOT: %s %s\n' "$USR" "$PID" "$TIME" "$TTY" "$IS_ROOT"
        done
}
# Run the main function of the script, clear and sort the output
main | sed '/grep sudo -i/d' | sort -k13 -k6

Call the script find-root, make it executable (chmod +x find-root) and execute it.

Here is a simple output:

$ ./find-root
spas    ( PID 14035  at 12:54 on TTY pts/20 ) is ROOT: 23518 sudo -i
spas    ( PID 14035  at 12:36 on TTY pts/4  ) is ROOT: 23589 sudo -i
guest   ( PID 23575  at 15:00 on TTY pts/4  ) is ROOT: 23589 sudo -i
guest   ( PID 24321  at 15:30 on TTY tty1   ) is ROOT: 24386 sudo -i

Here is a demonstration (within a mutt session) how the script works:

enter image description here

See also:

pa4080
  • 29.9k
  • 10
  • 89
  • 162