配置sudo日誌審計

1.檢查sudo與syslog服務

centos
[root@xiaoyuer ~]# rpm -qa|grep sudo
sudo-1.8.6p3-24.el6.x86_64
[root@xiaoyuer ~]# rpm -qa|grep syslog
rsyslog-5.8.10-10.el6_6.x86_64

ubuntu
root@host1:~# dpkg -l |egrep 'sudo|syslog'
ii  rsyslog                            7.4.4-1ubuntu2.7                           amd64        reliable system and kernel logging daemon
ii  sudo                               1.8.9p5-1ubuntu1.4                         amd64        Provide limited super user privileges to specific users
root@host1:~# 

2.檢查是否安裝兩種服務，若是沒有安裝，就使用下面的命令進行安裝　

yum install sudo -y
yum install rsyslog -y

apt-get  install sudo   rsyslog -y 

　備註：Centos 5.x 爲syslog，Centos 6.x 爲rsyslog

3.配置服務

#建立日誌目錄
mkdir -p /var/log/

#查看日誌環境
[root@xiaoyuer ~]# uname -r
2.6.32-642.6.2.el6.x86_64
[root@xiaoyuer ~]# cat /etc/redhat-release 
CentOS release 6.8 (Final)

root@host1:~# cat /etc/issue
Ubuntu 14.04.5 LTS \n \l
root@host1:~# uname -r
4.4.0-93-generic

#服務器環境爲centos 6.8 因此syslog日誌配置文件爲/etc/rsyslog.conf

echo "local2.debug /var/log/sudo.log">>/etc/rsyslog.conf

tail -1 /etc/rsyslog.conf
#local2.debug  /var/log/sudo.log

#注意：若是服務器爲centos 5.x 因此syslog日誌配置文件爲/etc/syslog.conf（配置）
#echo "local2.debug /var/log/sudo.log">>/etc/syslog.conf
#echo "Defaults logfile=/var/log/sudo.log">>/etc/sudoers

#配置/etc/sudoers
echo "Defaults logfile=/var/log/sudo.log">>/etc/sudoers
 tail -1 /etc/sudoers 
#Defaults logfile=/var/log/sudo.log
visudo -c

#重啓服務
[root@xiaoyuer ~]# service rsyslog restart
Shutting down system logger:                               [  OK  ]
Starting system logger:                                    [  OK  ]

四、測試審計結果

[root@xiaoyuer ~]# sudo ls
elasticsearch-5.6.3  elasticsearch-5.6.3.zip  energy_saving_products.sql  master.zip  mysql-5.7.22-winx64.zip  zabbix3.0.9_yum.tar.gz

[root@xiaoyuer ~]# cat /var/log/sudo.log 
Jul 31 14:59:20 : root : TTY=pts/0 ; PWD=/root ; USER=root ; COMMAND=/bin/ls