sudoers: Intrusion Detection

[pyllyukko]

As we saw on Sudo Mastery book

[pyllyukko]

sudo failed after copying 10-everything:

changed: [localhost] => (item=10-everything) => {"ansible_loop_var": "item", "changed": true, "checksum": "a125e779b6aa5cd0db4b55247be661f41c2208e6", "dest": "/etc/sudoers.d/10-everything", "gid": 0, "group": "root", "item": "10-everything", "md5sum": "6b3af6d526df67e94e5baa85c41e5833", "mode": "0400", "owner": "root", "size": 232251, "src": "/etc/sudoers.d.tmp/10-everything", "state": "file", "uid": 0}
failed: [localhost] (item=10-backup) => {"ansible_loop_var": "item", "changed": false, "item": "10-backup", "module_stderr": "\n/bin/sh: line 1: /usr/bin/python3: Permission denied\n", "module_stdout": "", "msg": "MODULE FAILURE\nSee stdout/stderr for the exact error", "rc": 126}

[pyllyukko]

I think this is close enough. This can be extended to other binaries as needed from here.