Skip to content

0069-sudo-logfile - sudo Log Not Configured or Deleted

Rule ID

  • 0069-sudo-logfile

Category

  • system

Level

  • warn

Compatible Versions

  • Linux

Description

  • sudo can use custom log files to record which commands users have run.

    Note: visudo edits the sudoers file in a safe way similar to vipw(8). visudo locks the sudoers file to prevent multiple simultaneous edits, provides basic integrity checks, and checks for parse errors. If the current user is editing the sudoers file, you will receive a message to try again later.

Scan Frequency

  • disable

Rationale

  • Used to record commands run by users

Risk

  • Inability to detect which user executed illegal commands

Audit Method

  • Verify that sudo is configured with a custom log file. Run the following command:
grep -Ei "^\s*Defaults\s+([^#;]+,\s*)?logfile\s*=\s*(")?[^#;]+(")?" /etc/sudoers
or
grep -Ei '^\s*Defaults\s+([^#;]+,\s*)?logfile\s*=\s*(")?[^#;]+(")?' /etc/sudoers.d/*
# Should output the following. If not, it is recommended to add sudo.log configuration
logfile ="/var/log/sudo.log"

Remediation

  • Use visudo or visudo -f to edit the file /etc/sudoers
logfile="/var/log/sudo.log"

Impact

  • After configuring sudo logs, you can view detailed information about which commands users executed, including execution time, login time, and login location.

Default Value

  • No configuration by default

References

CIS Controls

  • Version 7 6.3 Enable Detailed Logging Enable system logging to include detailed information such as an event source, date, user, timestamp, source addresses, destination addresses, and other useful elements.

Feedback

Is this page helpful?