Re: [SAGE] Re: Official sudosh announcement

[Doug Hanks <dhanks@gmail.com>]

Thanks for the feedback.  I'll just ignore your attitude, because I
know it runs rampant in the technical community.

sudosh provides accountability through syslog.  Nothing else out there does.

Imagine this:

su -
Password:
# csh
% rm /usr/tivoli/tsm/ba/dsm.sys
% exit
# exit

There would be no way you could tell what happened after that user
went into the csh, because csh doesn't support shell history.

I'm completely aware that this argument goes into the level of whether
or not you trust people who have root access to the server.  As I
said, this is for larger companies that have 10+ system administrators
and only login to other servers for which they aren't directly
responsible for when they are oncall.

When you're oncall, get a page, and need to troubleshoot the last
thing you want to do is work inside the restrictions of sudo using one
command at a time.

What about sudo -s?  Same deal as the above example.  As Bill
mentioned, hopping that shell history will make you accountable and
SOX compliant is "disingenuous at best."  Shell history is much more
easily modified or just deleted altogether.

This is why I created sudosh.  It uses script to grab all the input
and output and throw it off to syslog to pipe off to a central log
server.

If you wanted to modify the output you would have to do so on at least
2 servers and get the formatting right.  Not to mention you would have
to explain the syslog gap on the loghost that covers the amount of
time you took to perform the work, unless you scripted it.

Point being is that sudosh is identical to sudo -s, except your stuff
goes to syslog.  I also suggest you send the syslog to a central or
distributed loghosts.

Thanks for the feedback,

On Fri, 01 Oct 2004 10:45:55 -0400, William LeFebvre <bill@lefebvre.org> wrote:
> Exactly.  To imply, as the original poster did, that sudosh provides the
> accountability that is needed for SOx compliance is disingenuous at best.

-- 
- Doug Hanks = dhanks(at)gmail(dot)com