Recording user activity if they have “sudo bash” access

Question

I would like to monitor all the commands when a user calls sudo bash, including the rest of the commands.

Answer 1

Since version 1.7(ish?) sudo has an inbuilt logging feature.
In your sudoers file add:

User_Alias SHELL_USERS = root,user2 
Defaults:SHELL_USERS log_output 

Or for group based logging

Defaults:%shellusers log_output

Once a user uses sudo, everything they see will be captured and can be viewed in real time. Doesn't work so well when ncurses is involved.

http://www.gratisoft.us/sudo/sudoreplay.man.html