sudo incident reports

[SteveRiley]

[Rog132]

Naughty report

$ sudo mail
"/var/mail/root": 1 message 1 unread
>U 1 robm@npole Tue Dec 24 20:55 17/522 *** SECURITY information for npole ***
? 1
Return-Path: <robm@npole>
X-Original-To: root
Delivered-To: root@npole
Received: by npole (Postfix, from userid 1001)
id CC91D21DBB; Tue, 24 Dec 2013 20:55:24 +0200 (EET)
To: root@npole
From: robm@npole
Auto-Submitted: auto-generated
Subject: *** SECURITY information for npole ***
Message-Id: <20131224185524.CC91D21DBB@npole>
Date: Tue, 24 Dec 2013 20:55:24 +0200 (EET)
X-IMAPbase: 1387911346 3
Status: O
X-UID: 2

npole : Dec 24 20:55:24 : robm : user NOT in sudoers ; TTY=tty1 ; PWD=/home/robm ; USER=root ; COMMAND=/bin/su

? q
Saved 1 message in /home/sclause/mbox
Held 0 messages in /var/mail/root

[Snowhog]

Rog132, you crazy dude! I never would have guessed that you have a sense of humor!! Merry Christmas

[SteveRiley]

LOL!

Question: why does Santa still write those paper lists? He's staring at a PC there, surely he could set up a Cassandra database and track naughty/nice much more efficiently, no?

[Snowhog]

Santa is 'old school' dude!