On Dec 7, 2012, at 5:22 PM, Paul Schmehl wrote: > --On December 7, 2012 10:23:56 AM +0100 Fleuriot Damien <[email protected]> wrote: > >> >> On Dec 6, 2012, at 9:20 PM, Paul Schmehl <[email protected]> wrote: >> >>> --On December 6, 2012 1:19:00 PM -0600 Tim Daneliuk >>> <[email protected]> wrote: >>>> >>>> I understand this. Even the organization in question understands >>>> this. They are not trying to *prevent* any kind of access. All >>>> they're trying to do *log* it. Why? To meet some obscure >>>> compliance requirement they have to adhere to in order to >>>> remain in business. >>>> >>>> <rant> >>>> I know all of this is silly but that's our future when you >>>> let Our Fine Government regulate pretty much anything. >>>> </rant> >>>> >>> >>> I sent this last night, but for some reason it never showed up. >>> >>> /usr/ports/security/sudoscript >>> >>> I believe this will meet your requirements. >> >> >> I'm sorry to say it won't. >> Nothing will prevent a user from removing sudoscript's FIFO once he gets >> root privileges. >> > > Well, sure, but, if someone logs in and sudos to root, that will be logged by > sudoscript. If the logging then ceases, that would be cause for disciplinary > action up to and including dismissal. >
What about the case of: sudo vim or sudo vim file Surely that wouldn't raise an eyebrow, but… Then execute within vim: :sh or ^_^ -- Devin … and another gem … sr env HOME=$HOME vim then :E _____________ The information contained in this message is proprietary and/or confidential. If you are not the intended recipient, please: (i) delete the message and all copies; (ii) do not disclose, distribute or use the message in any manner; and (iii) notify the sender immediately. In addition, please be aware that any message addressed to our domain is subject to archiving and review by persons other than the intended recipient. Thank you. _______________________________________________ [email protected] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "[email protected]"
