How to get email for unauthorized sudo attempts?

Question

As per this question, unauthorized attempts to sudo are saved in /var/log/auth.log and by default, a mail is sent to /dev/null. Is there any way to prevent that from happening and send the mail to an actual domain?

score 2 · Answer 1 · answered Dec 22 '15 at 11:31

2

You need to setup sudo to write mails as stated on the page you have linked.

In your /etc/sudoers add mailto your@e.mail and the option when to send mails, in your case mail_badpass.

answered Dec 22 '15 at 11:31

user482705

21
3

Where in the sudoers file? – Jarwin Dec 22 '15 at 17:30
You already have mail_badpass in there, so you can just put the your e-mail address before it. – user482705 Jan 05 '16 at 07:39

score 0 · Answer 2 · answered Feb 21 '22 at 06:52

Later versions of Ubuntu (at least 21.10) suggest adding sudo configs into the /etc/sudoers.d directory. One can still add this in the /etc/sudoers file (remember to use visudo.)

Succinctly, to do what you want:

/etc/sudoers.d/mail-sysadmin

Defaults    mailto="email@example.com"

score 0 · Answer 3 · answered Apr 28 '23 at 07:27

To stop these e-mails when you type a wrong password you could also

type the correct password
use a password manager
use a password-less setup (see https://serverfault.com/a/160587/98708)

I guess you want an e-mail when someone else (e.g. Mallory) is using the wrong password to use sudo.

How to get email for unauthorized sudo attempts?

3 Answers3