Re: Auditd misses accept syscalls from sshd
On Fri, Dec 2, 2016 at 4:26 PM Paul Moore <paul(a)paul-moore.com> wrote:
On Fri, Dec 2, 2016 at 3:43 PM, Nathan Cooprider
<ncooprider(a)yankeehacker.com> wrote:
> Auditd seems to miss accept syscalls from ssh on Ubuntu 14. I tried
versions
> 2.3.2 and 2.4.5 of the daemon with kernel versions 3.13.0-96 and
4.4.0-47.
> In all cases the accept syscall (43) failed to show up until after I
> restarted the ssh daemon. It's especially weird because I don't see this
> problem on Ubuntu 16 (4.4.0-38). Any thoughts about why I am seeing this
or
> where to look?
>
> I found a similar question in the archives, but it seems to do with the
> architecture size and not OS versions:
> https://www.redhat.com/archives/linux-audit/2015-January/msg00060.html
>
> I also posted this question on Stack Overflow:
>
http://stackoverflow.com/questions/40940225/why-does-sshd-accept-syscall-...
I'm not really very aware of what Ubuntu is doing wrt to their default
audit configuration, but this really sounds like you need to add
'audit=1' to the kernel command line.
--
paul moore
www.paul-moore.com
Thanks for the suggestion. I'm getting other audit events from sshd without
restarting ssh. It's just the accept syscalls that do not show up until
after I restart ssh:
type=SYSCALL msg=audit(1480714641.465:54): arch=c000003e syscall=43
success=yes exit=5 a0=3 a1=7ffce3b031b0 a2=7ffce3b0319c a3=0 items=0 ppid=1
pid=2602 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
fsgid=0 tty=(none) ses=4294967295 comm="sshd" exe="/usr/sbin/sshd"
key=(null)
I think that indicates the kernel is sending up audit messages. My question
is why the above message fails to come up until after I've restarted ssh.
Attachments:
- attachment.html (text/html — 3.1 KB)