sudosh is a sudo shell and filter, and can be used as a login shell. It records all keystrokes and output and can play back the session. sudosh2 is a continuation of the development of sudosh.
sudosh was designed specifically to be used in conjunction with sudo or by
itself as a login shell.. sudosh allows the execution of a root shell with
logging. Every command the user types within the root shell is logged as
well as the output.
How is this different than "sudo -s" or "sudo /bin/sh" ?
Using "sudo -s" or other methods doesn't log commands typed to syslog.
Generally the commands are logged to a file such as .sh_history and if you
use a shell such as csh that doesn't support command-line logging you're
out of luck.
sudosh fills this gap. No matter what shell you use, all of the command
lines are logged to syslog (including vi keystrokes.)
Installation:
Compile sudosh.
1) ./configure
2) make
3) make install
4) sudosh -i
Configure sudosh to be used with sudo
1) configure /etc/sudoers to allow system administrators to execute
/usr/local/bin/sudosh
Example entry to /etc/sudoers:
-- /etc/sudoers begin --
User_Alias ADMINS=admin1,admin2,admin3
User_Alias DBAS=dba1,dba2,dba3
Cmnd_Alias SUDOSH=/usr/local/bin/sudosh
ADMINS ALL=SUDOSH
DBAS ALL=(oracle)/usr/local/bin/sudosh
-- /etc/sudoers end --
2) use it.
3) Look at the results with the sudosh-replay command.
Example usage to get ROOT ACCESS:
-- example usage begin --
# Get access to root
dhanks@linux:~> sudo sudosh
Password:
starting session for dhanks as root,/dev/tty3 (/bin/bash) (root-1108447320)
linux:~ # id
uid=0(root) gid=0(root) groups=0(root)
linux:~ # exit
exit
dhanks@linux:~>
-- example usage end --
Example usage to get ORACLE ACCESS:
-- example usage begin --
# Get access to oracle
dhanks@linux:~> sudo -u oracle sudosh
Password:
starting session for dhanks as oracle,/dev/tty3 (/bin/bash) (oracle-1108447391)
oracle@linux:~> id
uid=1001(oracle) gid=100(users) groups=100(users)
oracle@linux:~> exit
dhanks@linux:~>
-- example usage end --
Configure sudosh to be used as a login shell
1) Set the default shell to be used as a login shell. If you do not change
the default value /bin/sh will be used. Use the --with-defshell option
to configure to set this value.
2) If your system supports /etc/shells, add the absolute path to sudosh to
the list.
3) Edit /etc/passwd and set the user's shell to the absolute path of
sudosh (generally /usr/local/bin/sudosh unless you change the --prefix)
How To Replay Sessions
Use the "sudosh-replay" command to replay previous root sessions. To see
a list of available sessions execute "sudosh-replay" by itself.
-- example begin --
linux:~ # sudosh-replay
Sessions stored in /var/log/sudosh:
dhanks 1 session
Wed Oct 20 18:39:00 2004 (ID dhanks-1098322740)
Usage: sudosh-replay ID [MULTIPLIER] [MAXWAIT]
Example: sudosh-replay dhanks-1098322740 1 2
linux:~ #
-- example end--
As we can see there is 1 session available to view on my system at the
time of writing this documentation.
Use the ID to specify which session you which to replay. The ID is located
in the brackets after the date string. In this case our ID is
"dhanks-1098322740"
To view this session just as the user typed it, execute
"sudosh-replay dhanks-1098322740"
To merely just output the session data and ignore the timing information,
just set the multiplier to 0:
"sudosh-replay dhanks-1098322740" 0
The multiplier also works to speed up the session. If you wish to speed up
the session 2x, use a multiplier of 2
"sudosh-replay dhanks-1098322740" 2
If you have people that type slowly or if a user goes away from the keyboard,
you don't want to sit there and wait for the output. Instead set the MAXWAIT
variable. It's set to 1 by default.
"sudosh-replay dhanks-1098322740" 2 .5
Product's homepage
Find us on Google+
