Messaging supports privilege escalation. Technicians who need higher privileges are required to log in using their normal service accounts and then escalate their privileges to perform more restrictive tasks, for example, software upgrades. An escalation requires a password or ASG response that significantly restricts an intruder from root-level privileges.
To escalate access privileges, a technician uses sudo, a Linux/UNIX escalation utility that allows the user to login to another account. The user specifies the account to login to and must correctly respond to the request for the password or one-time-password of that account.
Log entries for privilege escalation and superuser activities appear in different logs:
Privilege escalation are logged in /var/log/secure.
Superuser (su) operations are logged in /var/log/ecs/commandhistory.
You can read the superuser permissions and restrictions by issuing the sudo -l command at the server CLI. This command escalates the user’s permissions to the superuser level and the output lists the commands that a superuser can and cannot run on the current host.