Track actions of user that sudo-ed/su-ed to root

Solution Verified - Updated -

Issue

  • How to use auditd to track actions by a user that has either become root via su or sudo.
  • How to configure Key stroke logging using pam_tty_audit in Red Hat Enterprise Linux ?

Environment

  • Red Hat Enterprise Linux 5.3 or above.
    • pam-0.99.6.2-4.el5 or above.
    • audit-1.6.5-9.el5 or above.
    • kernel-2.6.18-128.el5 or above.
    • bash-3.2-24.el5 or above.
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase of over 48,000 articles and solutions.

Current Customers and Partners

Log in for full access

Log In

New to Red Hat?

Learn more about Red Hat subscriptions

Close

Welcome! Check out the Getting Started with Red Hat page for quick tours and guides for common tasks.