Re: [SAGE] Re: Official sudosh announcement

[Doug Hanks <dhanks@gmail.com>]

Hi All,

Thanks for all of the good feedback.

Regardless of syslogs shortcomings, one of the most important things
about it is that syslog is portable.  It works on Linux, BSD, AIX,
Solaris, HPUX, and many others.  Syslog provides me a standard API and
it also timestamps my logs.  This allows me to use sudosh on a great
number of platforms instead of just Linux, which is common with open
source tools.

I do not claim that syslog is secure or highly dependant, but what it
does it provide a better mechanism than shell history itself to keep
track of a root shell.

SOX is a funny animal.  Most people don't understand it.  Most people
have read it, what little there is.  Some people have worked with PWC
contractors and have a better insight as to the requirements.  Some
people have already went through audits and have a very good idea of
what they're looking for.  I've been through all the stages.

At this point in time sudosh is working for SOX requirements.  It's
providing the base requirements that you need to be accountable.  I
can do so with the timestamps and multiple copies of my syslog.

Even when I submit the sudo patch into the main trunk it will still
use syslog, just as sudo itself does.  This isn't a problem with
sudosh or sudo.  It's a problem with the way the local administrator
performs logging.  If you want better logging I suggest you use
syslog-ng + SSL + stunnel + TCP + hosts.deny|allow.