Re: monitoring both logins and logouts via ssh in SLES10 SP1 RC2
On Friday 25 May 2007 13:21, Michael Folsom wrote:
Did a little test on a X86-64 SLES10 SP1 RC2 system - sshed into in
and did see the USER_LOGIN line then got out via either an exit or
logout and never see an USER_END statement.
If I remember correctly, there was a bug in a patch to sshd that called
pam_session_close from the unprivileged process. I think we moved this and
sent the patch upstream.
Could this be an issue in Suse's implementation of audit?
There might be a sshd patch that needs backporting from openssh cvs.
-Steve