On Wed, Aug 18, 2010 at 4:35 PM, Jason 'XenoPhage' Frisvold < [email protected]> wrote:
> -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > On Aug 16, 2010, at 6:23 PM, jplee3 wrote: > > Hi all, > > > > Just wondering if OSSEC has the ability to capture all commands run > > after sudoing or su'ing to root (or another privileged user, etc). > > I think this is outside of the scope of ossec.. Sudo itself doesn't log > that information (at least, not by default), and it doesn't appear in the > audit.log either. Build bash with "bash logger" support. This will send all bash history to the syslog server. You can then write OSSEC rules to "look" for certain things. Just a thought.
