Re: missing user authentication events.
On 03/25/2010 12:09 PM, Steve Grubb wrote:
On Thursday 25 March 2010 11:17:14 am Robert Harris wrote:
> My setup for auditd is the same in both places. However on the debian
> system I get no audit events for user authentication for things like ssh
> and su.
>
Maybe a Debian maintainer could answer how they do things...but in the mean
time, the login events come from user space. On RHEL/Fedora, we have enabled
auditing in the pam build.
-Steve
Would it be possible for me to check for it being enabled? it looks as
though it is not. is it very hard to add the fix? or would I be better
off trying to build a package from another distro that has it enabled?
I believe my libpam version is 0.81.12 and I have 0.81.8 on an opensuse
box that works just fine with user authentication auditing.