Logging problems

Lee_Brewer at discovery.com Lee_Brewer at discovery.com
Fri Sep 28 08:35:17 EDT 2001


Admins,

I have implemented sudo on my Tru64 5.1 patch level3 system and I have a
question about the logging

sudo -V yields

Sudo version 1.6.3p7

Authentication methods: 'sia'
Syslog facility if syslog is being used for logging: local2
Syslog priority to use when user authenticates successfully: notice
Syslog priority to use when user authenticates unsuccessfully: alert
Send mail if the user is not in sudoers
Lecture user the first time they run sudo
Require users to authenticate by default
Root may run sudo
Allow some information gathering to give useful error messages
Set the LOGNAME and USER environment variables
Length at which to wrap log file lines (0 for no wrap): 80
Authentication timestamp timeout: 5 minutes
Password prompt timeout: 5 minutes
Number of tries to enter a password: 3
Umask to use or 0777 to use user's: 022
Path to mail program: /usr/sbin/sendmail
Flags for mail program: -t
Address to send mail to: root
Subject line for mail messages: *** SECURITY information for %h ***
Incorrect password message: Sorry, try again.
Path to authentication timestamp dir: /var/run/sudo
Default password prompt: Password:
Default user to run commands as: root
Path to the editor for use by visudo: /usr/bin/vi
When to require a password for 'list' pseudocommand: any
When to require a password for 'verify' pseudocommand: all


I enter a entry in /etc/syslog.conf

local2.*       /var/adm/sudo.log
and issued a
touch /var/adm/sudo.log
I then
ps -ef | grep syslogd
and
kill -HUP <pid>

now if I su - <user>
then issue a
sudo ls
It asked for a password.  If I just press enter it prompts me two more times and
fails.....there is nothing in /var/adm/sudo.log...but I get mail to root
If I enter the correct password for the user, who is not in the /etc/sudoers
file, then I get an message stating this...with nothing in /var/adm/sudo.log,
but there is mail...

How can I tell if sudo is set for logging, I thought this was a default.  Will I
need to edit the configure and issue another make?

Lee Brewer





More information about the sudo-users mailing list