Unit 8: Logs and the timeline · Lesson 4 of 8 · 18 min

The sudo trail

Read who ran what as root, and find the evening the second root account was born.

mission

You are
You are finding out where sysops came from.
Situation
sudo logs every command it runs, with the user, the directory and the full command line. Yesterday's log is open on the right, searchable in your browser, and also on your machine.
Goal
Find every root command run on 13 October.
Hand in
Who created sysops, when, and what else they changed.

One sudo line

22:38:50 sudo: omar : TTY=pts/0 ; PWD=/home/omar ; USER=root ; COMMAND=/usr/sbin/useradd ...
  1. 122:38:50time
  2. 2omarwho
  3. 3USER=rootas whom
  4. 4COMMAND=/usr/sbin/useradd ...what
01

List the root commands

learner@root-lab
grep 'sudo:' auth.log.1 | awk -F'COMMAND=' '{split($1, a, " "); print a[3], $2}'
22:38:50 /usr/sbin/useradd -o -u 0 -g 0 -M -d /root -s /bin/bash sysops
22:41:07 /usr/bin/cp /tmp/k /usr/local/lib/.cache/kthreadd
22:42:30 /usr/bin/tee /etc/profile.d/proxy.sh
22:44:02 /usr/bin/tee /etc/cron.d/.sync-check
22:45:10 /usr/bin/tee /etc/systemd/system/kthreadd-helper.service

you should see useradd -o -u 0 deliberately creates a duplicate of root. The next four lines match the files you found in earlier units.

02

Confirm with useradd's own line

learner@root-lab
grep useradd auth.log.1 | tail -n 1
Oct 13 22:38:50 root-lab useradd[1154]: new user: name=sysops, UID=0, GID=0, home=/root, shell=/bin/bash, from=/dev/pts/0

defender tip In the browser lab, search sudo to see the same five lines, then useradd.

What a defender takes away

  1. 1sudo logs user, directory and full command.
  2. 2Cross-check with the program's own log line.
  3. 3Report facts, not conclusions about people.

Questions

0 of 3 solved

Answer each one from what you find on your lab machine.

  1. Show hint

    Search for useradd.

  2. Show hint

    The useradd lines.

  3. Show hint

    Search for 22:42.