From: Steve Grubb <sgrubb@redhat.com>
To: Frank Kruchio <fkruchio@nz1.ibm.com>
Cc: linux-audit@redhat.com
Subject: Re: command logging
Date: Tue, 8 Nov 2011 16:31:18 -0500 [thread overview]
Message-ID: <201111081631.18853.sgrubb@redhat.com> (raw)
In-Reply-To: <OFA15CC340.C126AE80-ONCC257942.0073F9E8-CC257942.007440EF@nz1.ibm.com>
On Tuesday, November 08, 2011 04:09:42 PM Frank Kruchio wrote:
> Thanks Steve !
>
> These are RHEL5 U7 however what happens if they ssh in, pam_tty_audit wont
> work I think.
> Since console login is disabled we are not thinking of using pam_tty_audit
> or can you use it for ssh logins as well ?
Should work fine there.
> if not, what are the options to trac users who share user ids ?
Users can share UIDs, but just not login as that UID. They have to login with their
own unique uid and then change to the shared account. Of course a cron job won't track
the auid, though. But you can disable cron for the shared account.
-Steve
prev parent reply other threads:[~2011-11-08 21:31 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-11-08 20:40 command logging Frank Kruchio
2011-11-08 20:59 ` Steve Grubb
[not found] ` <OFA15CC340.C126AE80-ONCC257942.0073F9E8-CC257942.007440EF@nz1.ibm.com>
2011-11-08 21:31 ` Steve Grubb [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=201111081631.18853.sgrubb@redhat.com \
--to=sgrubb@redhat.com \
--cc=fkruchio@nz1.ibm.com \
--cc=linux-audit@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.