From: Steve Grubb <sgrubb@redhat.com>
To: linux-audit@redhat.com
Cc: "Kirkwood, David A." <DAVID.A.KIRKWOOD@saic.com>
Subject: Re: Audit config for NISPOM req's
Date: Fri, 12 Jan 2007 11:38:31 -0500 [thread overview]
Message-ID: <200701121138.31139.sgrubb@redhat.com> (raw)
In-Reply-To: <954E3479CC27224785179CA04904214D04A041CF@0668-its-exmp01.us.saic.com>
On Friday 12 January 2007 11:09, Kirkwood, David A. wrote:
> I'm using RHEL4U4 and do not have autail. Where'd it come from?
http://www.redhat.com/archives/linux-audit/2006-October/msg00035.html
> Also, the doc I have does not metion the -rwxa option for watches.
That was a typo. It should have been -p rwxa. It should be in auditctl man
page.
> Separate question. With the watches I have enabled, I never am able to
> tie a user to an access violation. How do I do that?
It should be done automatically. The auid is the field that you would look at.
We've configured the pam settings for sshd,login,gdm, cron,vsftpd,remote to
include the pam_loginuid.so module. This is needed for it to work. Unless you
changed them, it should be setup at installation.
-Steve
next prev parent reply other threads:[~2007-01-12 16:38 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2006-12-22 13:38 Audit config for NISPOM req's Curtas, Anthony R.
2006-12-22 14:19 ` Steve Grubb
2006-12-22 15:08 ` Curtas, Anthony R.
2006-12-22 15:33 ` Steve Grubb
2006-12-22 16:22 ` Wieprecht, Karen M.
2006-12-22 16:25 ` Steve Grubb
2007-01-11 19:18 ` Wieprecht, Karen M.
2007-01-11 19:42 ` Steve Grubb
2007-01-12 16:09 ` Kirkwood, David A.
2007-01-12 16:38 ` Steve Grubb [this message]
2007-01-12 18:45 ` Kirkwood, David A.
2007-01-12 19:49 ` Steve Grubb
2007-01-16 15:51 ` Kirkwood, David A.
2007-01-16 16:15 ` Steve Grubb
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=200701121138.31139.sgrubb@redhat.com \
--to=sgrubb@redhat.com \
--cc=DAVID.A.KIRKWOOD@saic.com \
--cc=linux-audit@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.