Steve, et.al.
Here is a representative sample of audit.log entries recorded whenever
cron periodically (every minute) queries for cron entries that need
execution.
"
type=USER_ACCT msg=audit(1236084901.871:2382): user pid=20156 uid=0
auid=4294967295 msg='PAM accounting: user="root"
exe="/usr/sbin/crond"
(hostname=?, addr=?, terminal=cron result=Success)'
type=LOGIN msg=audit(1236084901.871:2383): login pid=20156 uid=0 old
auid=4294967295 new auid=0
type=USER_START msg=audit(1236084901.871:2384): user pid=20156 uid=0
auid=0 msg='PAM session open: user="root" exe="/usr/sbin/crond"
(hostname=?, addr=?, terminal=cron result=Success)'
type=CRED_ACQ msg=audit(1236084901.871:2385): user pid=20156 uid=0
auid=0 msg='PAM setcred: user="root" exe="/usr/sbin/crond"
(hostname=?,
addr=?, terminal=cron result=Success)'
type=CRED_DISP msg=audit(1236084902.141:2386): user pid=20156 uid=0
auid=0 msg='PAM setcred: user="root" exe="/usr/sbin/crond"
(hostname=?,
addr=?, terminal=cron result=Success)'
type=USER_END msg=audit(1236084902.141:2387): user pid=20156 uid=0
auid=0 msg='PAM session close: user="root" exe="/usr/sbin/crond"
(hostname=?, addr=?, terminal=cron result=Success)'
"
These events typically comprise at least 80% of all the audit.log
entries although they are repetitive thoughout the log and do not
indicate any user attempt to compromise the system.
Is there any relatively straight forward way that I can configure
Auditd to not record events for crond routinely running as root?
I am using audit-1.0.16-3.el4 on CentOS-4.7
Thanks!
Tom Call, LMCO