Track actions of user that sudo-ed/su-ed to root
Issue
- How to use auditd to track actions by a user that has either become root via su or sudo.
- How to configure Key stroke logging using pam_tty_audit in Red Hat Enterprise Linux ?
Environment
- Red Hat Enterprise Linux 5.3 or above.
- pam-0.99.6.2-4.el5 or above.
- audit-1.6.5-9.el5 or above.
- kernel-2.6.18-128.el5 or above.
- bash-3.2-24.el5 or above.
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.
