Ticket History #8270: No logging when a non-root ksu with command fails authorization

# Mon Oct 12 13:02:31 2015 Pat Riehecky <riehecky@fnal.gov> - Ticket created

To:	<krb5-bugs@mit.edu>
From:	Pat Riehecky <riehecky@fnal.gov>
Subject:	When using .k5users, commands are not logged
Date:	Mon, 12 Oct 2015 11:02:42 -0500

Download (untitled) / with headers
text/plain 481B

I'm looking to switch from sudo to .k5users, but the logging is reduced
by comparison.

For example:
sudo: riehecky : TTY=pts/2 ; PWD=/home/riehecky ; USER=root ;
COMMAND=/bin/ls -a
vs
ksu[15242]: pam_unix(ksu:session): session opened for user root by
riehecky(uid=1000)

Can the logging be increased so that the command and its arguments is
logged?

Pat

--
Pat Riehecky
Scientific Linux developer

Fermi National Accelerator Laboratory
www.fnal.gov
www.scientificlinux.org

# Thu May 31 16:01:44 2018 ghudson@mit.edu (Greg Hudson) - Status changed from 'new' to 'open'

# Thu May 31 16:01:44 2018 ghudson@mit.edu (Greg Hudson) - Comments added

Download (untitled) / with headers
text/plain 218B

The commit for this issue will fix logging when a non-root user tries
to ksu with a command and authorization fails. The context for that
change in scope is here:

https://bugzilla.redhat.com/show_bug.cgi?id=1270927

# Thu May 31 16:02:27 2018 ghudson@mit.edu (Greg Hudson) - Subject changed from 'When using .k5users, commands are not logged' to 'No logging when a non-root ksu with command fails authorization'

# Thu May 31 19:01:06 2018 ghudson@mit.edu (Greg Hudson) - Given to ghudson@mit.edu (Greg Hudson)

# Thu May 31 19:01:06 2018 ghudson@mit.edu (Greg Hudson) - Status changed from 'open' to 'resolved'

# Thu May 31 19:01:06 2018 ghudson@mit.edu (Greg Hudson) - Correspondence added

From:	ghudson@mit.edu
Subject:	git commit

Download (untitled) / with headers
text/plain 492B

Log when non-root ksu authorization fails

If non-root user attempts to ksu but is denied by policy, log to
syslog at LOG_WARNING in keeping with other failure messages.

https://github.com/krb5/krb5/commit/6cfa5c113e981f14f70ccafa20abfa5c46b665ba
Author: Robbie Harwood <rharwood@redhat.com>
Committer: Greg Hudson <ghudson@mit.edu>
Commit: 6cfa5c113e981f14f70ccafa20abfa5c46b665ba
Branch: master
src/clients/ksu/main.c | 10 ++++++++++
1 files changed, 10 insertions(+), 0 deletions(-)

# Sat Oct 27 11:45:53 2018 ghudson@mit.edu (Greg Hudson) - Version_Fixed 1.17 added