ConfigServer Community Forum

We have found that if a user is in a screen or tmux session and they su or sudo su an alert is not fired. If the user exits their screen/tmux session, the alerts will fire just fine.

It seems to be poorly documented that "who am i" does not properly return a user when the session is in screen/tmux. However, logname and other env variable such as $SUDO_USER will return the base user.

Is lfd making use of "who am i" when firing SU login alerts? And if so, can this be changed to a more reliable method of user detection?

We've looked at this a bit more, and see that it's actually the rows in the log file that are not writing properly:

su'ing outside of screen/tmux you get this: su'ing inside screen/tmux you get this: So while it may be possible to alter the lfd code to grab the second lines, it won't tell us who initiated the su session.