sudosh2 1.0.4

A sudo shell and filter, and can be used as a login shell

  Add it to your Download Basket!

 Add it to your Watch List!


Rate it!
send us
an update
Open Software License 
3.2/5 23
Douglas Richard Hanks, Jr. and Josh Gr...
ROOT \ System \ Shells
sudosh is a sudo shell and filter, and can be used as a login shell. It records all keystrokes and output and can play back the session. sudosh2 is a continuation of the development of sudosh.

sudosh was designed specifically to be used in conjunction with sudo or by
itself as a login shell.. sudosh allows the execution of a root shell with
logging. Every command the user types within the root shell is logged as
well as the output.

How is this different than "sudo -s" or "sudo /bin/sh" ?

Using "sudo -s" or other methods doesn't log commands typed to syslog.
Generally the commands are logged to a file such as .sh_history and if you
use a shell such as csh that doesn't support command-line logging you're
out of luck.

sudosh fills this gap. No matter what shell you use, all of the command
lines are logged to syslog (including vi keystrokes.)


Compile sudosh.

1) ./configure
2) make
3) make install
4) sudosh -i

Configure sudosh to be used with sudo

1) configure /etc/sudoers to allow system administrators to execute

Example entry to /etc/sudoers:

-- /etc/sudoers begin --
User_Alias ADMINS=admin1,admin2,admin3
User_Alias DBAS=dba1,dba2,dba3
Cmnd_Alias SUDOSH=/usr/local/bin/sudosh

DBAS ALL=(oracle)/usr/local/bin/sudosh
-- /etc/sudoers end --

2) use it.
3) Look at the results with the sudosh-replay command.

Example usage to get ROOT ACCESS:

-- example usage begin --
# Get access to root
dhanks@linux:~> sudo sudosh
starting session for dhanks as root,/dev/tty3 (/bin/bash) (root-1108447320)
linux:~ # id
uid=0(root) gid=0(root) groups=0(root)
linux:~ # exit
-- example usage end --

Example usage to get ORACLE ACCESS:

-- example usage begin --
# Get access to oracle
dhanks@linux:~> sudo -u oracle sudosh
starting session for dhanks as oracle,/dev/tty3 (/bin/bash) (oracle-1108447391)
oracle@linux:~> id
uid=1001(oracle) gid=100(users) groups=100(users)
oracle@linux:~> exit
-- example usage end --

Configure sudosh to be used as a login shell

1) Set the default shell to be used as a login shell. If you do not change
the default value /bin/sh will be used. Use the --with-defshell option
to configure to set this value.

2) If your system supports /etc/shells, add the absolute path to sudosh to
the list.

3) Edit /etc/passwd and set the user's shell to the absolute path of
sudosh (generally /usr/local/bin/sudosh unless you change the --prefix)

How To Replay Sessions

Use the "sudosh-replay" command to replay previous root sessions. To see
a list of available sessions execute "sudosh-replay" by itself.

-- example begin --
linux:~ # sudosh-replay

Sessions stored in /var/log/sudosh:

dhanks 1 session
Wed Oct 20 18:39:00 2004 (ID dhanks-1098322740)

Usage: sudosh-replay ID [MULTIPLIER] [MAXWAIT]
Example: sudosh-replay dhanks-1098322740 1 2
linux:~ #
-- example end--

As we can see there is 1 session available to view on my system at the
time of writing this documentation.

Use the ID to specify which session you which to replay. The ID is located
in the brackets after the date string. In this case our ID is

To view this session just as the user typed it, execute
"sudosh-replay dhanks-1098322740"

To merely just output the session data and ignore the timing information,
just set the multiplier to 0:
"sudosh-replay dhanks-1098322740" 0

The multiplier also works to speed up the session. If you wish to speed up
the session 2x, use a multiplier of 2

"sudosh-replay dhanks-1098322740" 2

If you have people that type slowly or if a user goes away from the keyboard,
you don't want to sit there and wait for the output. Instead set the MAXWAIT
variable. It's set to 1 by default.

"sudosh-replay dhanks-1098322740" 2 .5

Last updated on July 9th, 2010

#sudo shell #sudo filter #record keystrokes #sudo #shell #filter #keystrokes

Add your review!