Re: Linux Audit Framework question
On Wednesday, June 20, 2012 01:04:26 PM Jan wrote:
Hello,
I write you because i do not know how to go further without solving my
problem. When a user switches from username to root using sudo su - this
action is audited by LAF but since that change the user-id in the LAF
logfile is 0 for root user. If my user uses chmod afterwords to change file
permissions i can not see which user did the change because user-id is 0
and the auditid is always 4294967295. Can you tell me how it is possible to
trace the user after switching to root ??
Its sounds like your entry point is missing the following pam line:
session required pam_loginuid.so
This sets the loginuid which is inherited by each process the user creates.
So, if they get in by gdm, it needs to be in gdm's pam stack. If they get in
by sshd, it needs to be there. Etc.
-Steve