Embed Notice

Both sudo and doas give you good logs for auditing who did what and when.

su logs too but as most people just jump to a shell its less useful.

Allowing shell execution via sudo, or doas will also mean you lose fine grained audits, which is where their configuration power comes in handy. As now you're specifying exactly what people can do, and that is what gets logged.