Detections
Analytics

5.2.3 Ensure sudo log file exists

Information

The Defaults logfile entry sets the path to the sudo log file. Setting a path turns on logging to a file; negating this option turns it off. By default, sudo logs via syslog.

More information about the sudoers configuration files, their location, and load preference is available in the section overview.

Defining a dedicated log file for sudo simplifies auditing of sudo commands and creation of auditd rules for sudo.

Solution

Edit the file /etc/sudoers or a file in /etc/sudoers.d/ with visudo -f <PATH TO FILE> and add the following line:

Defaults logfile="<PATH TO CUSTOM LOG FILE>"

Example:

Defaults logfile="/var/log/sudo.log"

Impact:

WARNING: Editing the sudo configuration incorrectly can cause sudo to stop functioning. Always use visudo to modify sudo configuration files.

Creation of additional log files can cause disk space exhaustion if not correctly managed. You should configure logrotate to manage the sudo log in accordance with your local policy.

See Also

https://workbench.cisecurity.org/benchmarks/26236

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-3, 800-53|AU-3(1), 800-53|AU-7, 800-53|AU-12, CSCv7|6.3

Plugin: Unix

Control ID: 1f44a17a06b90d7d1af99243412bbc51778d39b720f41d70b60226cfef8e4fbb