Re: RHEL 5 audit events
On Tuesday 21 August 2007 09:52:03 Steve Grubb wrote:
> 1. su - "non_existent_account". Using the nispom.rules
provided by
> audit 1.5.6-1. Using various ausearch parameters, am unable to find a
> corresponding failure when attempting to "su" to a non-existent
> account.
On second thought...you were asking about su. This app has not been patched
for auditing...although I think it should be. In the meantime, you can put a
watch on the app:
-w /bin/su -p x -k su-used
[sgrubb src]$ su - badacct
su: user badacct does not exist
[root ~]# ausearch --start recent -k su-used -i
----
type=PATH msg=audit(08/21/2007 10:06:49.166:382) : item=1 name=(null)
inode=13107250 dev=08:08 mode=file,755 ouid=root ogid=root rdev=00:00
obj=system_u:object_r:ld_so_t:s0
type=PATH msg=audit(08/21/2007 10:06:49.166:382) : item=0 name=/bin/su
inode=24641546 dev=08:08 mode=file,suid,755 ouid=root ogid=root rdev=00:00
obj=system_u:object_r:su_exec_t:s0
type=CWD msg=audit(08/21/2007 10:06:49.166:382) :
cwd=/home/sgrubb/working/BUILD/coreutils-5.97/src
type=EXECVE msg=audit(08/21/2007 10:06:49.166:382) : a0="su" a1="-"
a2="badacct"
type=SYSCALL msg=audit(08/21/2007 10:06:49.166:382) : arch=x86_64
syscall=execve success=yes exit=0 a0=18172cd0 a1=18186460 a2=18192880 a3=8
items=2 ppid=6092 pid=6443 auid=sgrubb uid=sgrubb gid=sgrubb euid=root
suid=root fsuid=root egid=sgrubb sgid=sgrubb fsgid=sgrubb tty=pts1 comm=su
exe=/bin/su subj=user_u:system_r:unconfined_t:s0 key="su-used"
Hope this helps....
-Steve