sslogger(8) User Manuals sslogger(8)
NAME
sl, sslogger - execute a command as another user
SYNOPSIS
sl [-u user]
sl [-u user] [-h] ["command and args"]
sslogger [-h]
replay <filename>
DESCRIPTION
sslogger is session keystroke logging utility and allows permitted
users to execute commands, or open interactive shells as the superuser
or another user as specified by sudo rules in the sudoers file. When
used in interactive session mode, sslogger records keystrokes in a spe-
cial file. A tty is required for interactive sessions
sslogger also provides the ability to run in command mode in which a
command can be executed as another user. This allows sslogger to be
used within a script in non-interactive script. When running this mode,
stdin is closed.
Commands and interactive sessions write an entry to syslog. The default
keystroke log files are written to /var/log/sl/<host-
name>-<user1>-<user2>.<date>.log. The replay command is included to
review session log files created via sslogger, creating an audit trail
of all actions performed by users.
Privileged user escalation is set by standard sudo rules in sudoers
file.
OPTIONS
sl accepts the following command line options:
-u <USER>
Run command or interactive shell as USER
-h Stay in current working directory, do not cd to USER home dir
-f Flush buffer on every newline
["command and args"]
Execute "command and args" instead if interactive shell. Pro-
vides ability run sloggger within a script. non-interactive mode
The replay command can be used to repaly recorded sessions
replay <filename>
Replays interactive session identified by filename
replay help:
Press the following keys during the replay session
f Find a string (not implemented yet)
n Find the next match (not yet implemented)
r Find backwards (not implemented yet)*
b Back up 20 chars
1-9 Set replay speed, <space> to pause
<enter> Display next line enter
<space> Display next char
q quit
RETURN VALUES
In interactive mode, always exits 0.
When run in a non-interactive mode, sl returns the value of the command
being run.
FILES
/etc/sloger.conf
Configuration file
/etc/sudoers
Sudo Config file - see man sudoers(5) for details
/var/log/sl
Default directory in which sessions are logged
CONFIGURATION FILES
Sample entry for user1 and user2 in /etc/sudoers:
#Group Privileged access
User_Alias SSERS = user1,user2
Cmnd_Alias SL = /usr/bin/sslogger
SSERS ALL = (root,user3) NOPASSWD: SL
# user1 and user2 can now get an interactive root shell for root
and user3
# while logging all keystrokes
Config file /etc/sslogger.conf:
#Minimum Comment length in chars
#an entry of 0 will skip reason for asking for a shell
min_comment=10
#
#Maximum Comment Length in chars written to syslog
#Comment Length in the session logfile is currently unlimited
max_comment=200
/etc/group:
#To allow user2 to replay all session files, add user2 to the
sloggers group
sloggers:x:480:user2
EXAMPLES
Note: the following examples assume suitable sudoers(5) entries.
$ sl
- Obtains an interactive shell as root.
$ sl "ls -l /root"
- Runs a command as root, then exists.
$ sl -u user2
- Obtains an interactive shell as another user.
$sl -u user2 -h
- Obtains an interactive shell as user2 whilst remaining in the
current working directory.
$ replay <filename>
- Replays an interactive session log (requires user to be added
to sloggers group, see (CONFIGURATION FILES)
BUGS
If you feel you have found a bug in slogger, please submit a bug report
at http://XXXXX
SUPPORT
Limited free support is available via the slogger-users mailing list,
see http://xxxxxx to subscribe or search the archives.
AUTHOR
Edward Brand <edbrand@brandint.com>
SEE ALSO
sudo(8), suders(8), su(2)
Linux Febuary 2009 sslogger(8)
