Lesson 4.49: sudo session recording and safe sudo rules
sudo writes one line per command to the auth log, which tells you what someone started but not what they did inside it. With Defaults log_output sudo records the whole terminal session so you can replay it later. In the lab a contractor was allowed to edit /etc/hosts with vim through sudo. The recording shows what happened next: vim's shell escape gave them a root shell and they left a setuid copy of bash. You replay the session, remove the backdoor, replace the rule with sudoedit and validate the configuration.
17 min
You will learn to
- Enable sudo I/O logging (use_pty, log_output, logfile)
- List and replay sessions with sudoreplay
- Recognise shell escapes in sudo rules
- Replace editor rules with sudoedit
- Validate sudoers changes with visudo -c
Key terms
- log_output
- sudoers option: record everything the command prints (and with log_input, what is typed).
- sudoreplay
- Lists (-l) and replays recorded sudo sessions from /var/log/sudo-io.
- Shell escape
- A feature of a program that starts a shell or command (vim :!, less !, find -exec).
- sudoedit
- Edits a root file by copying it, running your editor as you, and copying it back.
- use_pty
- Runs the command in its own pseudo-terminal; needed for recording and blocks keystroke injection.
- visudo -c
- Checks every sudoers file for syntax errors.
← A quarterly access review · All lessons · Per-service network policy with systemd →