Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

add support for logging shell session data to syslog #49

Open
wschlich opened this issue Apr 4, 2024 · 2 comments
Open

add support for logging shell session data to syslog #49

wschlich opened this issue Apr 4, 2024 · 2 comments

Comments

@wschlich
Copy link

wschlich commented Apr 4, 2024

The following statement is written in the project README.md:

sudosh2 does not log sessions to syslog. If you need to consolidate session logs to a single location, logging them to a network filesystem is currently the recommended option.

This doesn't seem to make too much sense to me.

If an attacker can gain root privileges, he can probably just wipe these log files easily.

If sudosh2 could log to syslog which in turn could log remotely to an syslog server, these logs could not be wiped by an attacker.

@wschlich
Copy link
Author

wschlich commented Apr 4, 2024

A currently usable workaround for this problem could be to log session data to a local file using sudosh2 and having rsyslog slurp in this file using imfile, maybe: https://www.rsyslog.com/doc/configuration/modules/imfile.html

@squash
Copy link
Owner

squash commented Apr 4, 2024

Syslog messages specifically aren't a great fit for several reasons (including that the files aren't ascii text and would need to be bas64 encoded or similar). I'm always open to PRs but we've been in maintenance mode, since 2010 primarily fixing bugs and compatibility issues and I exited the enterprise sysadmin scene not long after.

A ground-up rewrite would be a prerequisite for me to add significant features.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants