- First Post
- Replies
- Stats
-
Go to
- ----- 2024 -----
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2023 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2022 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2021 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2020 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2019 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2018 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2017 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2016 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2015 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2014 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2013 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2012 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2011 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2010 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2009 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2008 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2007 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2006 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2005 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2004 -----
- December
- November
- October
- September
- August
Hello.
I wonder if someone can help me with an audit rule issue?
I want to log if someone uses the rpm command (to install/upgrade
packages), but not the rest of commands. Only the rpm command!
Is it possible? If so, can anyone please tell me how to write the rule
string? I've searched the internet, without success.
Regards
Roger Holm
Attachments:
- attachment.html (text/html — 2.8 KB)
On Tuesday 17 July 2007 10:05:12 Roger Holm wrote:
I want to log if someone uses the rpm command (to install/upgrade
packages), but not the rest of commands. Only the rpm command!
Sure:
-w /bin/rpm -p x -k rpm-is-running
I added the key to make searching for the results easier. It also helps you
know why the audit record was logged.
-Steve
On Tue, 17 Jul 2007 16:05:12 +0200, Roger Holm said:
I want to log if someone uses the rpm command (to install/upgrade
packages), but not the rest of commands. Only the rpm command!
What do you want it to do if they use 'yum' instead of 'rpm', or
'cp /bin/rpm /bin/innocent; /bin/innocent -Uvh evil-0.99.3.noarch.rpm'?
6312
days inactive
6314
days old
linux-audit@lists.linux-audit.osci.io
2 comments
3 participants
tags (0)
participants (3)
-
Roger Holm -
Steve Grubb -
Valdis.Kletnieks＠vt.edu