From: Paul Moore <paul@paul-moore.com>
To: "MAUPERTUIS, PHILIPPE" <philippe.maupertuis@equensworldline.com>
Cc: "linux-audit@redhat.com" <linux-audit@redhat.com>
Subject: Re: Full shell access or sudo command
Date: Fri, 27 Mar 2020 09:40:30 -0400 [thread overview]
Message-ID: <CAHC9VhT_ihVZkJ2U=2wtnNTPrJ8JQffas59rJ212vtcNCanZ5w@mail.gmail.com> (raw)
In-Reply-To: <5F4EE10832231F4F921A255C1D95429807639D60@DEERLM99EX7MSX.ww931.my-it-solutions.net>
On Fri, Mar 27, 2020 at 5:18 AM MAUPERTUIS, PHILIPPE
<philippe.maupertuis@equensworldline.com> wrote:
>
> Hi,
>
> Our sysadmins are able to use sudo to take a root shell and do whatever they want.
>
> On the contrary, application managers for example have only a limited set of sudo scripts and commands
>
> Is it possible to find if a given audit message (for example due to a watch on a file) has been issued in the context of sudo or a shell?
>
> My goal is to be able to search for potential sudo abuse through misconfiguration.
I'm sure others will have suggestions, probably better than mine, but
I would think that putting a watch on the sudo binary and paying
careful attention to the login UID ("auid" field) and session ("ses"
field) could be helpful.
--
paul moore
www.paul-moore.com
--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit
next prev parent reply other threads:[~2020-03-27 13:41 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-03-27 9:15 Full shell access or sudo command MAUPERTUIS, PHILIPPE
2020-03-27 13:40 ` Paul Moore [this message]
2020-03-27 14:36 ` Steve Grubb
2020-03-27 16:18 ` Richard Guy Briggs
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAHC9VhT_ihVZkJ2U=2wtnNTPrJ8JQffas59rJ212vtcNCanZ5w@mail.gmail.com' \
--to=paul@paul-moore.com \
--cc=linux-audit@redhat.com \
--cc=philippe.maupertuis@equensworldline.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.