From: Steve Grubb <sgrubb@redhat.com>
To: Michael Folsom <mwfolsom@gmail.com>
Cc: linux-audit@redhat.com
Subject: Re: monitoring both logins and logouts via ssh in SLES10 SP1 RC2
Date: Fri, 25 May 2007 13:52:32 -0400 [thread overview]
Message-ID: <200705251352.32349.sgrubb@redhat.com> (raw)
In-Reply-To: <ea5f6c090705251021v533d63bate3f7c088ab1d3b82@mail.gmail.com>
On Friday 25 May 2007 13:21, Michael Folsom wrote:
> Did a little test on a X86-64 SLES10 SP1 RC2 system - sshed into in
> and did see the USER_LOGIN line then got out via either an exit or
> logout and never see an USER_END statement.
If I remember correctly, there was a bug in a patch to sshd that called
pam_session_close from the unprivileged process. I think we moved this and
sent the patch upstream.
> Could this be an issue in Suse's implementation of audit?
There might be a sshd patch that needs backporting from openssh cvs.
-Steve
next prev parent reply other threads:[~2007-05-25 17:52 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2007-05-25 17:21 monitoring both logins and logouts via ssh in SLES10 SP1 RC2 Michael Folsom
2007-05-25 17:52 ` Steve Grubb [this message]
2007-05-25 18:00 ` Wieprecht, Karen M.
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=200705251352.32349.sgrubb@redhat.com \
--to=sgrubb@redhat.com \
--cc=linux-audit@redhat.com \
--cc=mwfolsom@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.