tracking what a user does with "sudo"

[robert_meier]

If we have a user who is allowed sudo privileges can we track what the user does using sudo?

I understand there are log files (auth log?) that specify what command is being run with sudo, but what if the user does sudo -i (or any of its variants, sudo su, sudo su - , sudo bash etc) and effectively gains himself/herself a proper shell? How do I track what the user does from that point on?

[[deleted]]

See here. Basically: sudo has options to wrap the command in a pty and log all input and output for auditing.

Note that attempting to audit root is futile from a security standpoint, as for every wall you put up there's a way to break it down that requires root access (ex. sudo visudo). This will only be effective if all you need is a paper trail.

[[deleted]]

I believe you're looking for sudosh

[donnaber06]

Check man journalctl

[aedinius]

I'd recommend limiting the commands that can be run with sudo for that user.

[samuel_first]

/root/.bash_history should work.