Linux Security Cookbook

5.17. Logging sudo Remotely

Problem

You want your sudo logs kept off-host to prevent tampering or interference.

Solution

Use syslog ’s @otherhost syntax: [Recipe 9.29]

               /etc/syslog.conf:
authpriv.*         @securehost

Discussion

Remember that the remote host’s syslogd needs must be invoked with the -r flag to receive remote messages. Make sure your remote host doesn’t share root privileges with the sudo host, or else this offhost logging is pointless.

See Also

syslog.conf(5), syslogd(8).