« Previous 1 2
Save sudo logs on a remote computer
Collection Point
Client Configuration for Secure Data Transmission
To let the client know to which system to send the sudo logs, use visudo to add the following statements to the sudoers file:
Defaults log_servers=<IP address>:30344(tls) Defaults log_server_cabundle=/etc/pki/tls/cert.pem
Of course, you will need to replace <IP address> with the IP address of the system on which you just set up the sudo_logsrvd service. From now on, the client's sudo session logs will end up on the central logging system. A call to sudoreplay -l should confirm this.
Conclusions
In the new 1.9 version, sudo now offers the ability to store I/O logs on remote systems. A new sudo_logsrvd service exists for this purpose, and it can communicate with clients over a secure TLS channel. To structure the data to be transmitted, sudo uses Google's Protocol Buffer Language [4].
Infos
- New features in sudo version 1.9.0: https://www.sudo.ws/stable.html#1.9.0
- sudo source code: https://github.com/sudo-project/sudo
- sudo download: https://www.sudo.ws/download.html
- Google Protocol Buffer Language: https://developers.google.com/protocol-buffers/docs/overview
« Previous 1 2
Buy this article as PDF
(incl. VAT)
Buy ADMIN Magazine
US / Canada
UK / Australia
Related content
- Quest Updates Unix sudo Tool
-
Advanced MySQL security tips (a complete guide)
Security safeguards protect data on MySQL servers. -
Assigning Privileges with sudo and PolicyKit
If you give users who are usually supervised more scope to help themselves, they will need additional privileges. The sudo tool and the PolicyKit authorization service can control who does what on Linux.
-
Certificate management with FreeIPA and Dogtag
The Dogtag certificate manager integrated into the FreeIPA open source toolset generates SSL/TLS certificates for intranet services and publishes them on the network. -
OpenLDAP Workshop
Centralized user management with LDAP or Active Directory is the standard today, although many prefer to manage user data manually rather than build this kind of infrastructure. In this article, we look at a better approach with OpenLDAP.