RE: Strange behavior with pam_tty_audit
-----Message d'origine-----
De : Steve Grubb [mailto:sgrubb@redhat.com]
Envoyé : mardi 14 novembre 2017 14:53
À : linux-audit(a)redhat.com
Cc : Maupertuis Philippe
Objet : Re: Strange behavior with pam_tty_audit
Hello,
On Tuesday, November 14, 2017 8:29:34 AM EST Maupertuis Philippe wrote:
> The auditd rules for PCI reads :
> ## 10.2.2 Log administrative action. To meet this, you need to enable
> tty ## logging. The pam config below should be placed into su and sudo
pam
> stacks. ## session required pam_tty_audit.so disable=* enable=root
>
> I have noticed that nothing happened unless I add in /etc/pam.d/sshd
> session required pam_tty_audit.so enable=*
If I understand, you deleted the 'disable=*' and replaced 'root' with
'*'.
That would be unusual. The command line is processed from left to right. So,
what should happen in the original rule is disable auditing of all users, then
enable auditing of only root. PCI wants administrative actions which would
only be the root user.
> At which point I get
>
> Should it be done that way ?
> Did I miss something ?
It works for me as specified in the PCI rules. (Tested using su.) Note that the
kernel caches the keystrokes and you do not get a 1x1 mapping of events to
commands entered. You will likely get multiple commands all strung
together.
It only creates the event when either it fills the buffer or the user ends the
privileged session.
I tried with su instead of sudo and it works as indicated in the doc.
The same line in sudo doesn't work, it seems there is a bug with sudo
I am on redhat 7.4 if that matters
-Steve
!!!*************************************************************************************
"Ce message et les pièces jointes sont confidentiels et réservés à l'usage
exclusif de ses destinataires. Il peut également être protégé par le secret professionnel.
Si vous recevez ce message par erreur, merci d'en avertir immédiatement
l'expéditeur et de le détruire. L'intégrité du message ne pouvant être assurée sur
Internet, la responsabilité de Worldline ne pourra être recherchée quant au contenu de ce
message. Bien que les meilleurs efforts soient faits pour maintenir cette transmission
exempte de tout virus, l'expéditeur ne donne aucune garantie à cet égard et sa
responsabilité ne saurait être recherchée pour tout dommage résultant d'un virus
transmis.
This e-mail and the documents attached are confidential and intended solely for the
addressee; it may also be privileged. If you receive this e-mail in error, please notify
the sender immediately and destroy it. As its integrity cannot be secured on the Internet,
the Worldline liability cannot be triggered for the message content. Although the sender
endeavours to maintain a computer virus-free network, the sender does not warrant that
this transmission is virus-free and will not be liable for any damages resulting from any
virus transmitted.!!!"