Re: [PATCH] auditd - TTY support for audisp-prelude
On Friday, June 17, 2011 11:10:41 AM Matteo Sessa wrote:
Attached is a patch for auditd to add support for TTY audits (
pam_tty_audit session module ) to audisp-prelude.
Alerts are reported with:
alert.classification.text = "Keylogger"
alert.assessment.impact.severity = LOW
Thanks for this contribution. I applied the patch with a couple minor revisions.
and actual keystrokes carried on alert.additional_data.
Because of this ^^^ I am disabling it by default since I think you want to stop and
consider if you really want keystrokes on your prelude database.
Attached you will find also a basic python commandline script to
query
keylogger data from prelude database.
If there was a little more explanation of this script in its text, I would add it to
the contrib section to preserve it.
Thanks,
-Steve