Detections
Analytics

5.2.3 Ensure sudo log file exists

Information

sudo logs successful and unsuccessful privilege-escalation attempts. On systems running sudo-rs (the default on Debian 13 and Ubuntu 26.04+), the logfile ( log_file ) Defaults option is not supported - sudo-rs always sends events to syslog under the authpriv facility. On classic sudo, both a dedicated Defaults logfile= file and syslog capture are available.

This recommendation ensures sudo events are captured in a durable, auditable log location regardless of the implementation in use.

A durable record of sudo invocations simplifies forensic investigation of privilege-escalation events, supports compliance auditing, and provides a tamper-evidence trail when paired with centralized log collection. On sudo-rs this is achieved exclusively via syslog/journald; on classic sudo, either a Defaults logfile or syslog can be used.

Solution

Configure durable capture of sudo events using the method appropriate for the installed implementation.

Method A - sudo-rs (Debian 13 default) and classic sudo via syslog:

Ensure rsyslog or systemd-journald is capturing authpriv.* events. To route sudo events to a dedicated file via rsyslog:

# printf '%s\n' '# CIS 5.2.3 - durable sudo event capture' \
 'authpriv.* /var/log/sudo.log' \
 > /etc/rsyslog.d/30-sudo.conf
# systemctl restart rsyslog

Then ensure the resulting file has appropriate permissions:

# touch /var/log/sudo.log
# chmod 0640 /var/log/sudo.log
# chown root:adm /var/log/sudo.log

Method B - classic sudo only (logfile= Defaults are supported and may be preferred):

Edit the file /etc/sudoers or a file in /etc/sudoers.d/ with visudo -f <PATH TO FILE> and add the following line:

Defaults logfile="/var/log/sudo.log"

WARNING: Defaults logfile="..." is silently ignored by sudo-rs. Do not rely on this method on a sudo-rs system - use Method A instead.

Notes:

 - sudo will read each file in /etc/sudoers.d, skipping file names that end in ~ or contain a . character to avoid causing problems with package manager or editor temporary/backup files.
 - Files are parsed in sorted lexical order. That is, /etc/sudoers.d/01_first will be parsed before /etc/sudoers.d/10_second.
 - Be aware that because the sorting is lexical, not numeric, /etc/sudoers.d/1_whoops would be loaded after /etc/sudoers.d/10_second.
 - Using a consistent number of leading zeroes in the file names can be used to avoid such problems.

Impact:

WARNING: Editing the sudo configuration incorrectly can cause sudo to stop functioning. Always use visudo to modify sudo configuration files.

See Also

https://workbench.cisecurity.org/benchmarks/27797

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-3, 800-53|AU-3(1), 800-53|AU-7, 800-53|AU-12, CSCv7|6.3

Plugin: Unix

Control ID: 92f27a14fbabc366158c1d307e318a6acd1685cf0ab117f3cd6592a8ab1612f5