[sudo-users] Rotating logs

[Todd C. Miller]

On Tue, 04 Aug 2015 12:18:56 -0500, Leroy Tennison wrote:

> I have an older Linux version and sudo doesn't have the maxseq option. I also
>  don't have the option of upgrading in the short term. Could manipulating the
>  contents of /var/log/sudo-io/ seq accomplish the same thing until an upgrade
>  can be done? 

You need to be careful doing this as older versions of sudo would
refuse to overwrite an existing I/O log.  If you can't upgrade the
machine but *can* upgrade the sudo package you'll find pre-built
packages for a variety of Linux distros at:
    http://www.sudo.ws/download.html#binary

> Second, on a newer machine (for testing) I used: 
> 
> Defaults maxseq=6 
> 
> in /etc/sudoers which worked but I noticed maxseq is listed under string para
> meters (even though it says a decimal value should be used). Should I use "De
> faults maxseq=6" or "Defaults maxseq='000006' " or is either acceptable? 

That's a documenation bug, maxseq should be listed as an integer.
That said, treating it like a string with double quotes shouldn't
be an issue as it will be parsed the same either way.  If you use
single quotes you should get an error like:

    sudo: value `'400'' is invalid for option `maxseq'

> Finally, after doing the above I tried to modify maxseq to be 400 but it didn
> 't have any effect even if I rebooted the device. I ended up removing maxseq,
>  logging out, logging back in (and using sudo -i) then re-adding maxseq to ge
> t the change to be implemented. Is this value being stored somewhere else tha
> t should be modified as well? 

Nope, sudoers is the only place maxseq needs to be set.  I can't
explain why it didn't seem to take effect.

 - todd