Re: Issue with apt command after setting log_subcmd option in /etc/sudoers file

Hello Todd,

Once again, thank you for your reply and the workaround provided.
It does work indeed.
However, I wanted to know the way the configuration file syntax is expected=
 to be handle by the system.
Indeed, I first configure the sudoers file as follow:
Defaults !/usr/bin/apt !log_subcmds (I tought that there were a missing spa=
ce between Defaults and the "!" character) but then it doesn't work.
And after that I set the parameter without the space and then aligned with =
your recommendation and then for sure it does work.
On the other lines of the sudoers file regarding the Defaults item there is=
 a space each time:
Defaults        env_reset
Defaults        mail_badpass
Defaults        secure_path=3D"/usr/local/sbin:/usr/local/bin:/usr/sbin:/us=
r/bin:/sbin:/bin:/snap/bin"
Defaults        use_pty
#Defaults       log_host, log_year
Defaults        log_input, log_output, log_subcmds
Defaults!/usr/bin/apt !log_subcmds

If you can provide me highlight on the way sudo behave with or without a sp=
ace, I will be very interested.

Regarding the sudo version, here are the detailed information:
sudo --version
Sudo version 1.9.9
Sudoers policy plugin version 1.9.9
Sudoers file grammar version 48
Sudoers I/O plugin version 1.9.9
Sudoers audit plugin version 1.9.9

I didn't find any more recent version available.

Have a good day.

Regards.

Ronan BERTIN-HUGAULT
Responsable du d=E9partement =AB=A0Z=E9ro Trust Security =BB
Digital Cloud Services
Orange/INNOV/IT-S/DCS/ZTS

[email protected]
Mobile=A0: +33 643253217


Orange Restricted

-----Message d'origine-----
De=A0: BERTIN HUGAULT Ronan INNOV/IT-S =

Envoy=E9=A0: lundi 27 mars 2023 15:15
=C0=A0: 'Todd C. Miller' <[email protected]>
Cc=A0: [email protected]
Objet=A0: RE: [sudo-users] Issue with apt command after setting log_subcmd =
option in /etc/sudoers file

Hello Todd,
Thank you for your prompt reply.
Regarding the sudo version, we are using the latest Ubuntu package availabl=
e.
We will try the workaround proposed and I will come back to you with the re=
sults.

Have a good day.

Regards.

Ronan BERTIN-HUGAULT
[email protected]
Mobile=A0: +33 643253217


Orange Restricted

-----Message d'origine-----
De=A0: Todd C. Miller <[email protected]> Envoy=E9=A0: vendredi 24 mars 2=
023 17:25 =C0=A0: BERTIN HUGAULT Ronan INNOV/IT-S <ronan.bertinhugault@oran=
ge.com> Cc=A0: [email protected] Objet=A0: Re: [sudo-users] Issue with apt=
 command after setting log_subcmd option in /etc/sudoers file

On Fri, 24 Mar 2023 13:38:25 -0000, [email protected] wrote:

> We are attempting in our environment to increase our capability to =

> check the commands used by our people when connecting to a VM through SSH.
> The targeted server is an Ubuntu 22.04 OS based.

What version of sudo are you running?  It looks like Ubuntu 22.04 ships sud=
o 1.9.9.  There have been a number of fixes to log_subcmds and intercept mo=
de since then.  If you are able to do so, I suggest trying the latest sudo =
package from https://www.sudo.ws/getting/packages/.

If not, you could disable log_subcmds for apt with a line like.

    Defaults!/usr/bin/apt !log_subcmds

It is probably not useful to log all the commands run by the apt install an=
d remove scripts.  Some of the package scripts run thousands of commands (g=
oogle-cloud-sdk is especially bad in this respect).

 - todd

___________________________________________________________________________=
______________________________________________

Ce message et ses pieces jointes peuvent contenir des informations confiden=
tielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu=
 ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages el=
ectroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou =
falsifie. Merci.

This message and its attachments may contain confidential or privileged inf=
ormation that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and dele=
te this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been =
modified, changed or falsified.
Thank you.

____________________________________________________________
sudo-users mailing list <[email protected]>
For list information, options, or to unsubscribe, visit:
https://www.sudo.ws/mailman/listinfo/sudo-users