4 ms·
Even with unlimited, no-password required sudo, it provides a valuable addition: audit logging. every command you run with sudo is logged, along with the user
by advisedwang 10y ago
Even with unlimited, no-password required sudo, it provides a valuable addition: audit logging.
every command you run with sudo is logged, along with the user than ran it. On GCP each end user is provisioned a separate login user, and logs can be shipped to Stackdriver Logging where they cannot be modified. This makes access really verifiable.
- tubs 10y agodisclaimer: I have no idea about Linux auditing: If you 'sudo -s' (or one of its friends) does the log still record the commands done in the "root shell"?
- secstate 10y agoNo, but you have a record of the user who typed 'sudo -s' which gives you an idea of where to start asking questions.
- sliken 10y agoSeems silly. Why create a pain in the ass for every command, instead of enabling auditing? Of course you should log which ssh credential started the session.
- dllthomas 10y agoI don't disagree with your thesis here, but "for every command" is substantially overstating the case.