Get an Email Every time Sudo is Used

Every time I use sudo on the command line I get an email.  This way I can always know if someone has attempted to run sudo on my computer.  Plus; combined with Gmail, it makes for an excellent audit trail.

I set it up following the guide here; Sudo email setup, original post

Or you can do the below.

I wanted to get an email from the computer every time sudo was used successfully or not. You need an MTA or mail transport agent. I have Postfix on my computer. There may be other ways to send an email; but that is beyond the scope of this post. I will show you what I did and I will assume you have an MTA already setup.

The first command tells visudo where to create the file. All edits should go to /etc/sudoers.d because this will make software updates more sane.

sudo visudo -f /etc/sudoers.d/mail_sudoers

File should look exactly like below. Be sure to include double quotes.

Defaults    mail_always
Defaults    mailto="youremail@gmail.com"

Visudo will set the proper permissions for you. No need for chmod if you are using Ubuntu 16.10 or later.

man sudo, visudo, sudoers will help greatly.
I’ve included a screenshot of what the email looks like. Naturally the important bits after the @ have been removed.

sudo

Leave a Reply

Please log in using one of these methods to post your comment:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s