June 2008 - Linux-audit - Linux-Audit List Archives

by Woodie, Paul E, CIV, DSS

I was delighted to see the functionality of audit-viewer. It displays audit logs in a much more user-friendly manner than ausearch does. However, I have been unable, at least so far, in getting audit-viewer, via its "List Properties" function to accept an ausearch expression. Paul Woodie, CISSP

18 years

1
0
0 / 0

aureport does not log logins

by Bo Phan

OS: Suse 9.3 aureport version 1.6.2 I know it's something that I need to see but I've been struggling with this project for so long. When I do aureport, logins (either successful or failed) are not showed. I watch the /var/log/audit/audit.log and it does not log any logins attempts. Frankly, my audit.rules has the following -w /var/log/faillog -p wa -k logins -w /var/log/lastlog -p wa -k logins But I guess it only watches changes in these 2 logs. Also, the /var/log/messages does show all login attempts if it points to something. Thanks all for your help. Bo

18 years

2
1
0 / 0

audit-viewer-0.3 released

by Miloslav Trmač

Hello, audit-viewer-0.3 was released. The most important changes in this release: * Make it possible to browse events using the "Event detail" dialog * Add "quick search" in event list results * Make it possible to open a tab in a new window * Support showing reports as bar * New translations: ca, de, el, it, pl audit-viewer-0.3 is available now at https://fedorahosted.org/audit-viewer/ and it will soon be available in Fedora 8, 9 and rawhide. Mirek

18 years

1
1
0 / 0

[PATCH]fix the problem of using strtoul in priority_boost_parse and flush_parse

by chuli

Hello， When the configure value of priority_boost or flush is larger than INT_MAX, auditd is still started successfully. The priority_boost_parser and flush_parse code use an int variable to store the result strtoul() and then compared with INT_MAX. The attached patch fixes the problem in src/auditd-config.c and audisp/audispd-config.c. Regards Chu Li

18 years

1
0
0 / 0

plugin auditing approach question

by LC Bruzenak

In our system we need to supply some specialized plugins to, for example evolution, which will be doing things that we desire to audit. However, we don't want to assign CAP_AUDIT_WRITE to evolution. I have an approach on which I wanted to get some feedback. I would create a library call and matching executable audit proxy. I'd give CAP_AUDIT_WRITE to the proxy. Then, the library call would fork/exec the audit proxy child, create a socket pair, and give each side their half of the pair. The sockets would persist until an explicit close (another library call, so that it told the proxy client to shut down through the socket interface) happened, so subsequent audits could use the interface. Also the child proxy would exit on socket close, etc. I can include the parent PID in the audit info. So if anyone has already done this or there is some reason for not choosing this path I'd appreciate comments. Thx, Lenny Bruzenak. -- LC (Lenny) Bruzenak lenny(a)magitekltd.com

18 years

2
2
0 / 0

Re: Problem with aureport

by Steve Grubb

On Wednesday 11 June 2008 17:22:27 Dave Quigley wrote: > If you ausearch -m avc -i you will get syscall numbers translated to > names as expected. I then tried aureport -a and instead of seeing > syscall names I see the numbers. aureport also takes the "-i" param to interpret numbers to names. Please give that a try. -Steve

18 years

1
0
0 / 0

Not auditing dispatchers

by Matthew Booth

The kernel ignores auditable events from the audit daemon, but is there an 'approved' way to achieve the same for dispatchers? The problem is the same, in that you get an infinite loop if the dispatcher itself performs any action which generates an audit record. Thanks, Matt -- Matthew Booth, RHCA, RHCSS Red Hat, Global Professional Services M: +44 (0)7977 267231 GPG ID: D33C3490 GPG FPR: 3733 612D 2D05 5458 8A8A 1600 3441 EA19 D33C 3490

18 years, 1 month

2
1
0 / 0

auparse question

by LC Bruzenak

I have successfully sent in a AUDIT_TRUSTED_APP user audit event & viewed that message picked off the stream by audisp. I send in my own n=v pairs. The auparse library code returns all the name elements but on a string value with embedded spaces it stops at the first space. On the sending side I have tried escaping double-quotes, single-quotes, and escaped single-quotes. I read through most of the list entries regarding this and also Steve's auparse text page and I must be missing the answer; apology in advance since after reading through most of the replies I realized it has been discussed thoroughly, but I do not see the answer. I also copied the example in the auparse_feed manpage, compiled that and tried to put some data into a file for an easy example. I cannot seem to get the right format in my event data file however. If someone has an example of that file data it would help, since I'd ideally like to use this setup for quick testing. Thx, LCB. -- LC (Lenny) Bruzenak lenny(a)magitekltd.com

18 years, 1 month

3
4
0 / 0

Announcing audit-viewer

by Miloslav Trmač

Hello, audit-viewer is now available in Fedora 9. It is a GUI for viewing audit logs and running simple reports on them, intended as an ueasy to use alternative to ausearch and aureport. To see what audit-viewer can do, please read https://fedorahosted.org/audit-viewer/wiki/AuditViewerTour . The program is still under development, more features (graphs in particular) and more polish is planned. I'll be grateful for any feedback (what works well, what doesn't work, what is difficult to do or unintuitive). To install audit-viewer on Fedora, run (yum install audit-viewer). Then you'll find it in the System/Administration menu as "Audit Logs". To build audit-viewer on other distributions, you'll need the source code available at https://fedorahosted.org/audit-viewer/ . audit-viewer depends on python-gtkextra, and the last release of python-gtkextra doesn't build on recent systems. You may find the patch at http://cvs.fedora.redhat.com/viewcvs/devel/python-gtkextra/ useful. Mirek

18 years, 1 month

2
4
0 / 0

[PATCH] Don't free() static data in libauparse

by Miloslav Trmač

Hello, The "interpretation" code in libuparse stores literal strings as interpreted data for the second operand of fcntl(). This causes a crash in free() when freeing the record. The attached patch fixes the crash. Mirek

18 years, 1 month

2
1
0 / 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Linux-audit June 2008