You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The following statement is written in the project README.md:
sudosh2 does not log sessions to syslog. If you need to consolidate session logs to a single location, logging them to a network filesystem is currently the recommended option.
This doesn't seem to make too much sense to me.
If an attacker can gain root privileges, he can probably just wipe these log files easily.
If sudosh2 could log to syslog which in turn could log remotely to an syslog server, these logs could not be wiped by an attacker.
The text was updated successfully, but these errors were encountered:
Syslog messages specifically aren't a great fit for several reasons (including that the files aren't ascii text and would need to be bas64 encoded or similar). I'm always open to PRs but we've been in maintenance mode, since 2010 primarily fixing bugs and compatibility issues and I exited the enterprise sysadmin scene not long after.
A ground-up rewrite would be a prerequisite for me to add significant features.
The following statement is written in the project
README.md
:This doesn't seem to make too much sense to me.
If an attacker can gain root privileges, he can probably just wipe these log files easily.
If sudosh2 could log to syslog which in turn could log remotely to an syslog server, these logs could not be wiped by an attacker.
The text was updated successfully, but these errors were encountered: