====== Linux - Sudo - Sudoers - Record tty commands run by a ldap user after sudo to a service account and store them to a file ======
Example:
[user@test1] / # sudo su - oracle
[oracle@test1] /home/oracle # hostname
test1
[oracle@test1] /home/oracle # pwd
/home/oracle
How to have sudo store these commands (hostname, pwd, etc) to a file after a user sudo to service account (oracle, etc) and run commands as that service account on a server?
----
===== Solution =====
First, create a log directory and set the sticky bit on it.
sudo mkdir -p /var/log/users_historylogs/
sudo chmod +t /var/log/users_historylogs/
Next, create a new script file under **/etc/profile.d/** directory.
sudo vi /etc/profile.d/history_log.sh
And add the below content at the bottom, save, and exit.
_who_am_i=$(whoami|awk '{print $1}')
_ID=$(id -u $_who_am_i)
if [ "$_ID" > 0 ]
then
export HISTSIZE=10000
export HISTTIMEFORMAT='%F %T '
export HISTFILE=/var/log/users_historylogs/history-users-$(whoami | awk '{print $1}';exit)-$(date +%F)
export PROMPT_COMMAND='history -a'
fi
Set the permission and enable the script.
chmod 770 /etc/profile.d/history_log.sh
source /etc/profile.d/history_log.sh
Now all user executed commands history saved to log fileā¦