Home

sudo-logger Wiki

A system for recording and replaying sudo sessions across a fleet of Linux servers.

Sessions are stored as asciinema v2 (session.cast) files — a single JSON-header file containing all metadata and terminal events. This format is directly compatible with the asciinema player and easy to ingest into a SIEM.

Architecture

┌─────────────────────────────┐        ┌──────────────────────────────┐
│  Client host (every server) │        │       Management host        │
│                             │        │                              │
│  sudo command               │        │  sudo-logserver              │
│    └─► sudo_logger_plugin   │  mTLS  │    └─► /var/log/sudoreplay/  │
│          └─► sudo-shipper ──┼───────►│         (session.cast files) │
│                             │        │                              │
│                             │        │  sudo-replay-server          │
└─────────────────────────────┘        │    └─► browser UI :8080      │
                                       └──────────────────────────────┘

Component	Package	Runs on
sudo_logger_plugin.so	sudo-logger-client	Every server
sudo-shipper	sudo-logger-client	Every server
sudo-logserver	sudo-logger-server	Management host
sudo-replay-server	sudo-logger-replay	Management host

Pages

• Installation — Install all three packages from RPM or source
• Configuration — Configure the plugin, shipper, server and replay
• Building-RPMs — Build RPMs from source
• Security — mTLS, ed25519 ACK signing, key management
• Replay-UI — Using the web-based session replay interface
• Hardening — Prevent users from tampering with or bypassing the logger
• SELinux-Policy — Build and deploy the SELinux confinement policy