Set up per-user root logging on nixos hosts

oysteikt commented

2026-01-22 05:56:39 +01:00

Owner

On most of the salt-registered hosts, we have the following script in the global bashrc:

umask 022

if [ ! -z "$PS1" ] ; then

	# LOGNAME skal være sett være satt til brukeren som har blitt root.
	# Vi prøver først å bruke kommandoen "logname", denne vil gi riktig
	# resultat dersom vi har brukt "su" for å bli root.
	if [ "$LOGNAME" = "root" -o -z "$LOGNAME" ]; then
		export LOGNAME=$(logname)
	fi

	# Dersom vi fortsatt ikke vet hvilken bruker som er blitt root, 
	# så får vi vel bare spørre da.
	while [ "$LOGNAME" = "root" -o -z "$LOGNAME" ]; do
		echo -n "LOGNAME er '$LOGNAME' (ikke fornuftig), hvem er du? " > /dev/stderr
		read ln
		export LOGNAME=$ln
	done

	# Skal ikke være miljøvariabler.
	HISTFILE=~/.bash_history.$LOGNAME
	HISTFILESIZE=1000
	HISTSIZE=1000
	unset MAILCHECK

	# Default prompt
	PS1='\h:\w\$ '

	# La brukere ha sin egen bashrc om de vil
	[ -f $HOME/.bashrc.$LOGNAME ] && . $HOME/.bashrc.$LOGNAME

fi

Maybe we should consider doing the same on the nixos hosts?

On most of the salt-registered hosts, we have the following script in the global `bashrc`: ```bash umask 022 if [ ! -z "$PS1" ] ; then # LOGNAME skal være sett være satt til brukeren som har blitt root. # Vi prøver først å bruke kommandoen "logname", denne vil gi riktig # resultat dersom vi har brukt "su" for å bli root. if [ "$LOGNAME" = "root" -o -z "$LOGNAME" ]; then export LOGNAME=$(logname) fi # Dersom vi fortsatt ikke vet hvilken bruker som er blitt root, # så får vi vel bare spørre da. while [ "$LOGNAME" = "root" -o -z "$LOGNAME" ]; do echo -n "LOGNAME er '$LOGNAME' (ikke fornuftig), hvem er du? " > /dev/stderr read ln export LOGNAME=$ln done # Skal ikke være miljøvariabler. HISTFILE=~/.bash_history.$LOGNAME HISTFILESIZE=1000 HISTSIZE=1000 unset MAILCHECK # Default prompt PS1='\h:\w\$ ' # La brukere ha sin egen bashrc om de vil [ -f $HOME/.bashrc.$LOGNAME ] && . $HOME/.bashrc.$LOGNAME fi ``` Maybe we should consider doing the same on the nixos hosts?

👎 1

oysteikt added the good first issue security nixos labels 2026-01-22 05:56:39 +01:00

oysteikt added this to the Kanban project 2026-01-22 05:56:39 +01:00

oysteikt referenced this issue

2026-01-22 05:59:34 +01:00

Improve per-user root logging, allow setting username with envvar on login #304

oysteikt moved this to Medium priority in Kanban on 2026-01-22 06:14:08 +01:00

danio added the disputed label 2026-01-22 08:06:24 +01:00

felixalb commented

2026-01-22 13:05:06 +01:00

Owner

Logging who did what might be cool, but I think we should coordinate it with #138, and use something like auditd rather than a hacky script setting LOGNAME. Getting prompted with the question is also a bit annoying.

Also, we should keep in mind that this is not useful not to uncover malicious admin activity, as we still allow users to log in directly as root, bypassing the userlogin + privesc flow that a bashrc or auditd could pick up. If the point is troubleshooting other problems/accidents, how useful is knowing whodunit?

Logging who did what might be cool, but I think we should coordinate it with https://git.pvv.ntnu.no/Drift/issues/issues/138, and use something like `auditd` rather than a hacky script setting LOGNAME. Getting prompted with the question is also a bit annoying. Also, we should keep in mind that this is not useful not to uncover malicious admin activity, as we still allow users to log in directly as root, bypassing the userlogin + privesc flow that a bashrc or auditd could pick up. If the point is troubleshooting other problems/accidents, how useful is knowing whodunit?

felixalb commented

2026-01-22 13:07:25 +01:00

Owner

However, having your own .bash_history to not get other peoples histories messing up your autocomplete is cool, but you can implement that yourself without the need for this system everywhere

oysteikt commented

2026-01-22 13:40:30 +01:00

Author

Owner

Getting prompted with the question is also a bit annoying

See #304

> Getting prompted with the question is also a bit annoying See #304

Set up per-user root logging on nixos hosts #303