Detections
Analytics

5.2.5 Ensure sudo log file exists

Information

The Defaults logfile entry sets the path to the sudo log file. Setting a path turns on logging to a file; negating this option turns it off. By default, sudo logs via syslog.

Defining a dedicated log file for sudo simplifies auditing of sudo commands and creation of auditd rules for sudo.

Solution

Edit the file /etc/sudoers or a file in /etc/sudoers.d/ with visudo -f <PATH TO FILE> and add the following line:

Defaults logfile="<PATH TO CUSTOM LOG FILE>"

Example:

Defaults logfile="/var/log/sudo.log"

Because sudo applies the last matching Defaults definition, place this setting so that no later-parsed file in /etc/sudoers.d overrides it; see this section's overview for how the sudoers files combine.

Notes:

 - sudo will read each file in /etc/sudoers.d, skipping file names that end in ~ or contain a . character to avoid causing problems with package manager or editor temporary/backup files.
 - Files are parsed in sorted lexical order. That is, /etc/sudoers.d/01_first will be parsed before /etc/sudoers.d/10_second.
 - Be aware that because the sorting is lexical, not numeric, /etc/sudoers.d/1_whoops would be loaded after /etc/sudoers.d/10_second.
 - Using a consistent number of leading zeroes in the file names can be used to avoid such problems.

Impact:

Creation of additional log files can cause disk space exhaustion if not correctly managed. You should configure logrotate to manage the sudo log in accordance with your local policy.

See Also

https://workbench.cisecurity.org/benchmarks/27893

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-3, 800-53|AU-3(1), 800-53|AU-7, 800-53|AU-12, CSCv7|6.3

Plugin: Unix

Control ID: c96539dd1c19b37e0c50452d71bd5b1e9ee245f4affde95808a1324037068c09