CODEWITHSUNDEEP
linuxbashsecurity
rahuL
rahuL

Reputation: 3420

Detect use of su command in bash

I would like to know if there is anyway to send a mail as soon as someone tries su -, su or su root. I know the mail command and I am trying to write a script but I am very confused as to

I've tried the usual Google search etc. but got links on usage of su, disabling it, securing ssh etc - none of which answered this question.

Thanks in advance

Upvotes: 2

Views: 1286

Answers (3)

Nick
Nick

Reputation: 2050

I guess that your underlying requirement is that you have a bunch of people you have given root privilege to but you don't completely trust them so you want to keep an eye on them. Your solution to this is to get yourself sent mail whenever they become root.

The problem with this solution is that the root user has unlimited privilege and so there's nothing to stop them from counteracting this mechanism. They could for instance, edit the /etc/login.defs file in one session, do the good thing that you want them to do and then later su to root and do the bad thing that you fear and at the end of that session they edit the /etc/login.defs file back to it's original state and you're none the wiser. Alternatively they could just make a copy of /usr/bin/bash and make the copy a suid file that will give them privilege whenever they run it.

You might be able to close any of the vulnerabilities I've just suggested but there will be many, many more. So you either trust them or else don't use su at all and give them sudo permission to run just those commands that they need to do the thing you want them to do.

Upvotes: 4

lurker
lurker

Reputation: 58224

There's a log file called /var/log/secure which receives an entry any time su is executed. It gets entries under other conditions as well. It's described in the Linux Administrator's Security Guide.

If user "fred" executes su -, an entry will appear which looks something like this:

Jul 27 08:57:41 MyPC su: pam_unix(su-l:session): session opened for user root by fred(uid=500)

A similar entry would appear with su or su root.

So you could set up a script which monitors /var/log/secure as follows:

#!/bin/sh
while inotifywait -e modify /var/log/secure; do
  if tail -n1 /var/log/secure | grep " su: "; then
    tail -n1 /var/log/secure | grep " su: " | mail -s "su occurred" [email protected]
  fi
done

Note that you need to have the inotify-tool package installed to use inotifywait.

If this script is running in the background, it should send an email to [email protected] any time an su entry occurs.

Now where to run the script. One approach would be to put this into an executable script file (say, watchsu) and call it from your rc.local file:

nohup /path/to/watchsu 2>&1 &

I'm sure there are other ideas for where to start it. I'm not familiar with CentOS.

Upvotes: 3

Andrew Schulman
Andrew Schulman

Reputation: 3544

According to the man page for su, in /etc/login.defs you can set either SULOG_FILE file or SYSLOG_SU_ENABLE yes to log all su activity. Then you just need something like inotifywait to watch the log file for su events.

Upvotes: 2

Related Questions