Mail me when someone runs command using sudo – Linux Security

There is situation that i wanted to monitor all the sudo users activity, When ever they type an command using sudo i should get an email. This is very important when your working as a Linux Security Administrator / Security analyst.  As a Linux Administrator you should have an evidence to prove somebody is screed up something in your environment.

Restrict your Administrator’s to use sudo for all the important commands by writing an restriction in /etc/sudoers file.

Most of the time what we will do is we will provide an full rights to the administrator based an there designation and level of exportation, but we don’t know what he / she is doing an the production environment. In order to monitor the typed commands with sudo, We have to add below lines to the configuration file.

Add the entry to the /etc/sudoers as mentioned below, It will send you an alert whenever user type the command using sudo. Providing the the path of the log file it will save an every executed command as shown in below:

~]$ sudo visudo
###### Get every alert when user fired an command with sudo #### 
Defaults        syslog_goodpri=alert
Defaults        logfile=/var/log/sudo.log
Defaults        timestamp_timeout=0, log_year
Defaults        mailto="linuxbiginner@gmail.com", mail_always