5:49 p.m.
I read my audit logs.I always see lots of auid values are 4294967295. Even
when I delete a file, the value is still 4294967295?
I added pam_loginuid to gdm, login, kdm, sshd, vsftpd. Howver, it is still
the same value?
I wonder what is wrong?
6:37 p.m.
BTW, I put audit=1 to my grub.conf and restarted my host. Still the same
On Tue, Jul 23, 2013 at 3:49 PM, zhu xiuming <xiumingzhu(a)gmail.com> wrote:
I read my audit logs.I always see lots of auid values are 4294967295.
Even
when I delete a file, the value is still 4294967295?
I added pam_loginuid to gdm, login, kdm, sshd, vsftpd. Howver, it is
still the same value?
I wonder what is wrong?
8:53 a.m.
On Tuesday, July 23, 2013 03:49:31 PM zhu xiuming wrote:
I read my audit logs.I always see lots of auid values are 4294967295.
Even
when I delete a file, the value is still 4294967295?
In a normal system, there will be some events with 4294967295. These should be
daemons and system events. Anything caused by a user should have the auid set
to their uid. This is done by pam_loginuid.
I added pam_loginuid to gdm, login, kdm, sshd, vsftpd. Howver, it is
still
the same value?
I wonder what is wrong?
cat /proc/self/loginuid
If that shows the account you logged in with, its working. If not, then
something is wrong with pam or the kernel.
-Steve
5:35 p.m.
Thanks.
I removed quiet from gruf.conf and I see from the output at boot.
I do see like
start audit [ok]
The problem is, cat /proc/self/loginuid is still 4294967295 if I login.
However, I do see lots of events the auid is 0. I even see auid change
reflect in the event.
Like
type=LOGIN msg=audit(07/20/2013 17:45:01.502:40221) : login pid=4952
uid=root old auid=unset new auid=root
So, I am really confused.
On Wed, Jul 24, 2013 at 6:53 AM, Steve Grubb <sgrubb(a)redhat.com> wrote:
On Tuesday, July 23, 2013 03:49:31 PM zhu xiuming wrote:
> I read my audit logs.I always see lots of auid values are 4294967295.
Even
> when I delete a file, the value is still 4294967295?
In a normal system, there will be some events with 4294967295. These
should be
daemons and system events. Anything caused by a user should have the auid
set
to their uid. This is done by pam_loginuid.
> I added pam_loginuid to gdm, login, kdm, sshd, vsftpd. Howver, it is
still
> the same value?
> I wonder what is wrong?
cat /proc/self/loginuid
If that shows the account you logged in with, its working. If not, then
something is wrong with pam or the kernel.
-Steve
--
Linux-audit mailing list
Linux-audit(a)redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit
6:54 p.m.
On Thursday, July 25, 2013 03:35:52 PM zhu xiuming wrote:
The problem is, cat /proc/self/loginuid is still 4294967295 if I
login.
However, I do see lots of events the auid is 0. I even see auid change
reflect in the event.
Like
type=LOGIN msg=audit(07/20/2013 17:45:01.502:40221) : login pid=4952
uid=root old auid=unset new auid=root
This would be a root login. Which should be forbidden since root is a shared
account amongst admins.
So, I am really confused.
Something is wrong in your pam setup. You might check the compile flags or if
pam_loginuid is in the right section. But that is undoubtedly the problem.
-Steve
6:58 p.m.
So, what should be the right settings for pam_loginuid? Is there any
documentation ?
thanks a lot
On Thu, Jul 25, 2013 at 4:54 PM, Steve Grubb <sgrubb(a)redhat.com> wrote:
On Thursday, July 25, 2013 03:35:52 PM zhu xiuming wrote:
> The problem is, cat /proc/self/loginuid is still 4294967295 if I login.
>
> However, I do see lots of events the auid is 0. I even see auid change
> reflect in the event.
> Like
>
> type=LOGIN msg=audit(07/20/2013 17:45:01.502:40221) : login pid=4952
> uid=root old auid=unset new auid=root
This would be a root login. Which should be forbidden since root is a
shared
account amongst admins.
> So, I am really confused.
Something is wrong in your pam setup. You might check the compile flags or
if
pam_loginuid is in the right section. But that is undoubtedly the problem.
-Steve
4:20 p.m.
HI,
Finally, I found it out the order of pam_loginuid was wrong. It should be
the first part of session required modules.
Now, it works
Thanks a lot
On Thu, Jul 25, 2013 at 4:58 PM, zhu xiuming <xiumingzhu(a)gmail.com> wrote:
So, what should be the right settings for pam_loginuid? Is there any
documentation ?
thanks a lot
On Thu, Jul 25, 2013 at 4:54 PM, Steve Grubb <sgrubb(a)redhat.com> wrote:
> On Thursday, July 25, 2013 03:35:52 PM zhu xiuming wrote:
> > The problem is, cat /proc/self/loginuid is still 4294967295 if I login.
> >
> > However, I do see lots of events the auid is 0. I even see auid change
> > reflect in the event.
> > Like
> >
> > type=LOGIN msg=audit(07/20/2013 17:45:01.502:40221) : login pid=4952
> > uid=root old auid=unset new auid=root
>
> This would be a root login. Which should be forbidden since root is a
> shared
> account amongst admins.
>
>
> > So, I am really confused.
>
> Something is wrong in your pam setup. You might check the compile flags
> or if
> pam_loginuid is in the right section. But that is undoubtedly the problem.
>
> -Steve
>
4166
days inactive
4169
days old
linux-audit@lists.linux-audit.osci.io
6 comments
2 participants
participants (2)
-
Steve Grubb -
zhu xiuming