mediumaccess-controlverified ✓rollback-safe
Ensure sudo commands are logged
sudo-logfile · RHEL ≥ 8 · 1 impl
Description
The logfile option in sudoers configuration specifies a file where sudo will log all sudo commands. This provides an audit trail of privileged command execution.
Rationale
Logging sudo commands provides accountability and allows administrators to track privileged access. This is essential for incident response and compliance auditing.
Check → Remediate
Checkcommand
grep -rPh '^\s*Defaults\s+logfile=' /etc/sudoers /etc/sudoers.d/ 2>/dev/null
- expected_exit:
- 0
Remediateconfig_set_dropin
- dir:
- /etc/sudoers.d
- file:
- 00-kensa-logfile
- key:
- Defaults
- value:
- logfile="/var/log/sudo.log"
Framework references
CIS
rhel8 5.2.3rhel9 5.2.3rhel10 5.2.3
NIST 800-53
AU-2AU-12
Live verification
rhel10:checkrhel8:checkrhel9:check
#sudo#privilege-escalation#logging#audit