Lion Cipher Lab
See what the admin actually did: record and replay privileged sessions with sudo I/O logging
- Identity & Access Management
- Intermediate
- ~60 min
- Free · no account required
Why it matters
When something goes wrong on a server, the first question is 'who had root?' and the second — the one that actually matters — is 'what did they do with it?'. Ordinary sudo logging answers the first and shrugs at the second: it records that an administrator started a shell, not the forty commands they typed inside it. That gap is where insider mistakes hide, where an attacker who stole an admin's credentials operates unseen, and where an auditor's question goes unanswered. sudo can record the terminal session itself and play it back like a screen recording, and it is built into a tool already…
What you'll learn
- sudo I/O session logging (log_output)
- replaying an administrator's terminal session with sudoreplay
- editing sudoers safely with visudo and visudo -c
- sudoers drop-in files in /etc/sudoers.d
- scoping recording with LOG_OUTPUT / NOLOG_OUTPUT tags
- reading and searching a session ledger by user, tty, command and date
- recognising the password-capture hazard of log_input
- understanding why local audit logs must be shipped off-box
- choosing between sudo I/O logging, auditd, script and session-recording products
Steps in this lab
- The blind spot: your sudo log knows a command ran, not what it did
- Build a throwaway machine, and put an administrator on it
- Meet visudo — the seatbelt you fasten before touching policy
- Build the blind spot on purpose, so you can see it
- Turn on I/O logging
- Record a real privileged session
- Read the ledger with sudoreplay -l
- Watch it back — and skip the dead air
- Search the sessions instead of scrolling them
- Scope it: record what matters, and meet the ordering trap
- The hazard: log_input records keystrokes, and keystrokes include passwords
- The limit: whoever reaches root can delete the evidence
- Why this, not that — and when not to record at all
- Tear it down, and take the instinct with you