From: Steve Grubb <sgrubb@redhat.com>
To: linux-audit@redhat.com
Subject: Re: Tracking account lockouts and permission denied
Date: Wed, 1 Oct 2008 16:25:39 -0400 [thread overview]
Message-ID: <200810011625.39328.sgrubb@redhat.com> (raw)
In-Reply-To: <0FED9929-66E9-4A72-85B7-5DE790B06446@arlut.utexas.edu>
On Wednesday 01 October 2008 15:58:44 Starr-Renee Corbin wrote:
> Hello, I am using RHEL 4 and need /var/log/audit/audit.log to show
> when an account is locked out
This is hardwired into the pam_talley2 code. As long as its in your login
config and audit is enabled, you should get it.
> and when a user is denied permission to
> security relevant files such as /etc/shadow.
In RHEL4, you can get accesses to /etc/shadow via watches, but not just the
denied because of permission. aureport --file --failed would find them for
you.
You can also get all opens that failed due to permission denied. This would
include more than /etc/shadow, though.
RHEL5 and current upstream kernels do not have this limitation and can record
the permission denied access to security relevant files.
-Steve
prev parent reply other threads:[~2008-10-01 20:25 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2008-10-01 19:58 Tracking account lockouts and permission denied Starr-Renee Corbin
2008-10-01 20:25 ` Steve Grubb [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=200810011625.39328.sgrubb@redhat.com \
--to=sgrubb@redhat.com \
--cc=linux-audit@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.