From: Steve Grubb <sgrubb@redhat.com>
To: linux-audit@redhat.com
Cc: "MAUPERTUIS, PHILIPPE" <philippe.maupertuis@equensworldline.com>
Subject: Re: Full shell access or sudo command
Date: Fri, 27 Mar 2020 10:36:33 -0400 [thread overview]
Message-ID: <1930026.6Tes88mm62@x2> (raw)
In-Reply-To: <5F4EE10832231F4F921A255C1D95429807639D60@DEERLM99EX7MSX.ww931.my-it-solutions.net>
On Friday, March 27, 2020 5:15:37 AM EDT MAUPERTUIS, PHILIPPE wrote:
> Hi,
> Our sysadmins are able to use sudo to take a root shell and do whatever
> they want. On the contrary, application managers for example have only a
> limited set of sudo scripts and commands Is it possible to find if a given
> audit message (for example due to a watch on a file) has been issued in
> the context of sudo or a shell? My goal is to be able to search for
> potential sudo abuse through misconfiguration.
Assuming direct root login is disabled since root is a shared account, then
any event with uid ==0 and session != -1 has to be under sudo/su.
-Steve
--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit
next prev parent reply other threads:[~2020-03-27 14:36 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-03-27 9:15 Full shell access or sudo command MAUPERTUIS, PHILIPPE
2020-03-27 13:40 ` Paul Moore
2020-03-27 14:36 ` Steve Grubb [this message]
2020-03-27 16:18 ` Richard Guy Briggs
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1930026.6Tes88mm62@x2 \
--to=sgrubb@redhat.com \
--cc=linux-audit@redhat.com \
--cc=philippe.maupertuis@equensworldline.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.