-
Notifications
You must be signed in to change notification settings - Fork 2
/
README.old
140 lines (105 loc) · 4.29 KB
/
README.old
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
This documentation is fairly out of date. For the latest, please go to
the project homepage at http://sudosh2.sourceforge.net/
Introduction:
=============
sudosh is a filter and can be used as a login shell. sudosh takes advantage
of pty devices in order to sit between the user's keyboard and a program, in
this case a shell.
sudosh was designed specifically to be used in conjunction with sudo or by
itself as a login shell.. sudosh allows the execution of a root shell with
logging. Every command the user types within the root shell is logged as
well as the output.
How is this different than "sudo -s" or "sudo /bin/sh" ?
Using "sudo -s" or other methods doesn't log commands typed to syslog.
Generally the commands are logged to a file such as .sh_history and if you
use a shell such as csh that doesn't support command-line logging you're
out of luck.
sudosh fills this gap. No matter what shell you use, all of the command
lines are logged to syslog (including vi keystrokes.)
Installation:
=============
Compile sudosh.
1) ./configure
2) make
3) make install
4) sudosh -i
Configure sudosh to be used with sudo
=====================================
1) configure /etc/sudoers to allow system administrators to execute
/usr/local/bin/sudosh
Example entry to /etc/sudoers:
-- /etc/sudoers begin --
User_Alias ADMINS=admin1,admin2,admin3
User_Alias DBAS=dba1,dba2,dba3
Cmnd_Alias SUDOSH=/usr/local/bin/sudosh
ADMINS ALL=SUDOSH
DBAS ALL=(oracle)/usr/local/bin/sudosh
-- /etc/sudoers end --
2) use it.
3) Look at the results with the sudosh-replay command.
Example usage to get ROOT ACCESS:
-- example usage begin --
# Get access to root
dhanks@linux:~> sudo sudosh
Password:
starting session for dhanks as root,/dev/tty3 (/bin/bash) (root-1108447320)
linux:~ # id
uid=0(root) gid=0(root) groups=0(root)
linux:~ # exit
exit
dhanks@linux:~>
-- example usage end --
Example usage to get ORACLE ACCESS:
-- example usage begin --
# Get access to oracle
dhanks@linux:~> sudo -u oracle sudosh
Password:
starting session for dhanks as oracle,/dev/tty3 (/bin/bash) (oracle-1108447391)
oracle@linux:~> id
uid=1001(oracle) gid=100(users) groups=100(users)
oracle@linux:~> exit
dhanks@linux:~>
-- example usage end --
Configure sudosh to be used as a login shell
============================================
1) Set the default shell to be used as a login shell. If you do not change
the default value /bin/sh will be used. Use the --with-defshell option
to configure to set this value.
2) If your system supports /etc/shells, add the absolute path to sudosh to
the list.
3) Edit /etc/passwd and set the user's shell to the absolute path of
sudosh (generally /usr/local/bin/sudosh unless you change the --prefix)
4) To allow things like scp, sft, cvs, rsync, etc, use the "-c arg allow" in
sudosh.conf. The allowed command will need to match what is being sent to
it, notably some OpenSSH servers will call /usr/lib/openssh/sftp-server.
How To Replay Sessions
======================
Use the "sudosh-replay" command to replay previous root sessions. To see
a list of available sessions execute "sudosh-replay" by itself.
-- example begin --
linux:~ # sudosh-replay
Sessions stored in /var/log/sudosh:
===================================
dhanks 1 session
Wed Oct 20 18:39:00 2004 (ID dhanks-1098322740)
Usage: sudosh-replay ID [MULTIPLIER] [MAXWAIT]
Example: sudosh-replay dhanks-1098322740 1 2
linux:~ #
-- example end--
As we can see there is 1 session available to view on my system at the
time of writing this documentation.
Use the ID to specify which session you which to replay. The ID is located
in the brackets after the date string. In this case our ID is
"dhanks-1098322740"
To view this session just as the user typed it, execute
"sudosh-replay dhanks-1098322740"
To merely just output the session data and ignore the timing information,
just set the multiplier to 0:
"sudosh-replay dhanks-1098322740" 0
The multiplier also works to speed up the session. If you wish to speed up
the session 2x, use a multiplier of 2
"sudosh-replay dhanks-1098322740" 2
If you have people that type slowly or if a user goes away from the keyboard,
you don't want to sit there and wait for the output. Instead set the MAXWAIT
variable. It's set to 1 by default.
"sudosh-replay dhanks-1098322740" 2 .5