1.3.3 Ensure sudo log file exists

Information

sudo can use a custom log file

Note: visudo edits the sudoers file in a safe fashion, analogous to vipw(8). visudo locks the sudoers file against multiple simultaneous edits, provides basic sanity checks, and checks for parse errors. If the sudoers file is currently being edited you will receive a message to try again later. The -f option allows you to tell visudo which file to edit.

Rationale:

A sudo log file simplifies auditing of sudo commands

Impact:

Editing the sudo configuration incorrectly can cause sudo to stop functioning

Solution

edit the file /etc/sudoers or a file in /etc/sudoers.d/ with visudo or visudo -f <PATH TO FILE> and add the following line:

Defaults logfile='<PATH TO CUSTOM LOG FILE>'

Example:

Defaults logfile='/var/log/sudo.log'

See Also

https://workbench.cisecurity.org/files/2925

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-12, CSCv7|6.3

Plugin: Unix

Control ID: 82237d9b7a25fd68681aa750bb0e7855edd44d006bfa076d09d4b1ac6891bbc1