Linux-audit March 2007

linux-audit@lists.linux-audit.osci.io

17 participants
24 discussions

Minimum kernel version for auditd 1.0.14

by Walt Powell

What is the minimum Linux kernel version required for audit-1.0.14? I.e does it require a kernel upgradeto update a system from 1.0.12 to 1.0.14? Walt Powell

17 years, 9 months

2
1
0 / 0

by Mackanick, Jason W CTR DISA GIG-OP

Classification: UNCLASSIFIED Caveats: NONE Hello everyone, Newbie to the list. I am in position of writing technical implimentation guidance for DISA and I am looking for a method to audit logins/logouts. I have not been able to come up with a syscall that would cover this. Any help would be appreciated. Jason Mackanick, CISSP DISA FSO Supports & Standards Section Technical Support Team Classification: UNCLASSIFIED Caveats: NONE

17 years, 10 months

4
7
0 / 0

Auditing detach in Laus

by Matthew Booth

I realise that Laus is not the primary focus of this list, but I'm hoping there might be some experience here. I'd like to audit a Laus detach, which as I understand it is implemented as an ioctl (AUIOCDETACH) on /dev/audit. For debugging purposes, I've stripped my rule back to the following: tag "AUDIT_ioctl" syscall ioctl = is-auditdevice(arg0); I get nothing on detach, although I get plenty of other hits on this rule. My best guess is that it doesn't evaluate these rules until call completion, by which time the process is already detached. Is this right? If so, this would be a fairly severe architectural flaw. Either way, I'd like to be able to make an informed recommendation to my customer. Thanks, Matt -- Red Hat, Global Professional Services M: +44 (0)7977 267231 GPG ID: D33C3490 GPG FPR: 3733 612D 2D05 5458 8A8A 1600 3441 EA19 D33C 3490

17 years, 10 months

1
0
0 / 0

New to audit. Need help configuring audit to meet NISPOM req's

by Fields, Randy (Space Technology)

Hello All, I'm a linux administrator and computer security rep with a small NIS domain all running RHEL 4.4 ES on x86 platforms. I'm looking for any help, scripts, or just copies of configuration files so that I can learn from your examples while studying the man pages. Here are the list of items that I need to accomplish and I greatly appreciate any help that you can provide. 1) I need to configure a test box to meet NISPOM audit requirements. (any examples of /etc/auditd.conf and /etc/audit.rules would be great) 2) Then test it by acting as a user and trying to access files such as /etc/passwd and /etc/shadow. 3) Then report that data to prove to auditors that the tool is collecting the events. Thank you in advance. Feel free to e-mail me directly to avoid any unwanted cluttering of the message boards. Randy Fields randy.fields(a)ngc.com

17 years, 10 months

6
12
0 / 0

← Newer
1
2
3
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Linux-audit March 2007