You can do this with the root user pretty easy using rootsh: http://sourceforge.net/projects/rootsh/ We use it on all our servers and it can be very handy.
Aaron Thul http://www.chasingnuts.com On Mon, Aug 16, 2010 at 6:23 PM, jplee3 <[email protected]> wrote: > Hi all, > > Just wondering if OSSEC has the ability to capture all commands run > after sudo'ing or su'ing to root (or another privileged user, etc). > > > TIA! >
