Sudo For Defense: How can new or lesser-known features help you?
summary
Demonstrates that sudo 1.9 actually streams central session recording to a collector, adds Python plugin support so sudo can inspect IO, query ticketing/HR, alert or terminate sessions, and exposes audit and approver APIs for real‑time reactions. Shows concrete integrations: syslog‑ng -> Slack alerts, a Rust-based sudo‑pair approver that successfully approves/rejects shells, and Python proofs‑of‑concept that break sessions when “my secret” or a dangerous rm -rf pattern appears.
AI-written summary · about
chapters (33)
- 0:00Overview
- 0:13What is sudo?
- 1:38Basic /etc/sudoers
- 3:38Aliases
- 4:11Defaults
- 4:57Insults
- 5:22Digest verification
- 5:51Session recording
- 6:28Plugin-based architecture
- 9:34Configuration hints
- 10:48Sample Configuration
- 12:02Central management
- 13:11Logging and alerting
- 14:35Configuring syslog-ng
- 15:03syslog-ng.conf: getting started
- 15:36syslog-ng.conf: sudo building blocks
- 16:03syslog-ng.conf: sudo log statement
- 16:43sudo logs in Slack
- 16:59What is new sudo 1.9
- 17:34Recording Service
- 18:47Audit plugin
- 19:32Approval Plugin framework
- 20:41Python Support
- 22:23Policy plugin API example: code
- 23:17Policy plugin API example: screenshot
- 24:42IO logs API example 1 (output check): code
- 26:1510 logs API example 2 (input check): code
- 26:49Io logs API example 2 (input check): screenshot
- 27:0910 logs API example 3 (conversation): code
- 29:35Group plugin API example
- 29:54Chroot and CWD support
- 32:24Not just a prefix, but...
- 35:01Questions?
