Offline configuration

Hi, Now that I've got auditing to work on Fedora Core, I have a few more questions. First, the boxes I've got it working on are connected to the internet and have the latest updates. Now I need to make stuff work on boxes that are *not* connected to the internet and are built off of the base CD/DVD. I know I need the latest versions of the following packages on a system audit audit-lib glibc-kernheaders openssh openssh-server openssh-client openssh-askpass openssh-askpass-gnome Do I need the latest of audit-libs-devel kernel as well? Also, what other packages are critical to get NISPOM compliance? Even when I updated the above packages, it didn't look like failed logins on the gnome desktop were generating events. I realize this may be particular to RHEL_64, but I also figured I could just have an outdated package. I'm asking this because when I set up my audit rules on RHEL4_64 with the base auditing installed (none of the above updates). I wasn't getting any login/logout events at all, based on my initial experience with the initial Fedora configurations, I assume that I need to install updated packages. I'm not using watches right now, only syscalls, which seem to catch everything I need. It seems like Steve has put enough information in the event logs that it is possible to build a GUI that parses, combines, and then displays the event logs to the user. Each displayed event is on a single line and contains the pertinent information about the event. The only gotcha I had with FC5 was that I needed the updated openssh packages to generate the events that indicated a logout event for ssh. Bob Evans JHU/APL