Can the Audit Daemon Determine the Difference Between Two Users Running Commands Simultaneously After Each User has Sudo'd to the Root User?

Solution Unverified - Updated 2024-08-06T05:39:45+00:00 -

Issue

Example: User John and User Jane log into a system with their unique users accounts. They both sudo su - root. One of them runs malicious commands, the other does not. How do you determine which user ran the malicious commands since they were both logged in as root at the same time?

A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.