From mboxrd@z Thu Jan 1 00:00:00 1970 From: salgak@comcast.net Subject: Audit: audisp-remote plugin: why is OpenLDAP a dependency ?? Date: Mon, 9 Feb 2015 13:47:36 +0000 (UTC) Message-ID: <473290240.2225092.1423489656934.JavaMail.zimbra@comcast.net> References: <924112195.2223087.1423489490422.JavaMail.zimbra@comcast.net> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============0183073961562810886==" Return-path: Received: from mx2.redhat.com (ext-mx01.extmail.prod.ext.rdu2.redhat.com [10.11.55.1]) by int-mx11.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id t19Dleet010711 for ; Mon, 9 Feb 2015 08:47:40 -0500 Received: from resqmta-ch2-07v.sys.comcast.net (resqmta-ch2-07v.sys.comcast.net [69.252.207.39]) by mx2.redhat.com (8.14.4/8.14.4) with ESMTP id t19DlcZR013907 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES128-SHA bits=128 verify=FAIL) for ; Mon, 9 Feb 2015 08:47:38 -0500 In-Reply-To: <924112195.2223087.1423489490422.JavaMail.zimbra@comcast.net> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com --===============0183073961562810886== Content-Type: multipart/alternative; boundary="----=_Part_2225091_351148828.1423489656933" ------=_Part_2225091_351148828.1423489656933 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit I'm currently dealing with a VMware appliance, and need to export my audit logs. Despite VMware telling me to use the audisp-remote plugin with auditd, I get a dependency check for OpenLDAP, and the install fails. I'm pointing to my audit server (a Splunk box) via IP address. Is there any workaround, or am I stuck adding even MORE software to the appliance ?? ______________________________________________________________________________________ It is by Caffeine alone, that I set my Mind in Motion. It is by the Beans of Java that thought acquires speed, the hands develop shakes, the shakes become a warning. It is by Caffeine alone that I set my Mind in Motion. ______________________________________________________________________________________ ------=_Part_2225091_351148828.1423489656933 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable
I'm currently dealing with a VMware ap= pliance, and need to export my audit logs.  Despite VMware telling me = to use the audisp-remote plugin with auditd, I get a dependency check for O= penLDAP, and the install fails.

I'm pointing to my audit server (a = Splunk box) via IP address.   Is there any workaround, or am I st= uck adding even MORE software to the appliance ??

<= div>
_____________________________________= _________________________________________________
It is by Caffeine alone, that I set my Mind in = Motion.
It is by the Beans of Java that thought acquires speed, the hand= s develop shakes, the shakes become a warning.
It is by Caffeine alone t= hat I set my Mind in Motion.

____________________________________= __________________________________________________

------=_Part_2225091_351148828.1423489656933-- --===============0183073961562810886== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============0183073961562810886==-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: Audit: audisp-remote plugin: why is OpenLDAP a dependency ?? Date: Mon, 9 Feb 2015 18:00:58 +0100 Message-ID: <20150209180058.54f930bd@ivy-bridge> References: <924112195.2223087.1423489490422.JavaMail.zimbra@comcast.net> <473290240.2225092.1423489656934.JavaMail.zimbra@comcast.net> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <473290240.2225092.1423489656934.JavaMail.zimbra@comcast.net> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: salgak@comcast.net Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Mon, 9 Feb 2015 13:47:36 +0000 (UTC) salgak@comcast.net wrote: > I'm currently dealing with a VMware appliance, and need to export my > audit logs. Despite VMware telling me to use the audisp-remote plugin > with auditd, I get a dependency check for OpenLDAP, and the install > fails. > > I'm pointing to my audit server (a Splunk box) via IP address. Is > there any workaround, or am I stuck adding even MORE software to the > appliance ?? The package the plugin is included in contains all of them. The zos-remote plugin is the one that wants openldap. -Steve From mboxrd@z Thu Jan 1 00:00:00 1970 From: salgak@comcast.net Subject: Re: Audit: audisp-remote plugin: why is OpenLDAP a dependency ?? Date: Mon, 9 Feb 2015 17:26:15 +0000 (UTC) Message-ID: <1286467080.2438459.1423502775408.JavaMail.zimbra@comcast.net> References: <924112195.2223087.1423489490422.JavaMail.zimbra@comcast.net> <473290240.2225092.1423489656934.JavaMail.zimbra@comcast.net> <20150209180058.54f930bd@ivy-bridge> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============2126377246526831628==" Return-path: Received: from mx1.redhat.com (ext-mx16.extmail.prod.ext.phx2.redhat.com [10.5.110.21]) by int-mx09.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id t19HQIKE013018 for ; Mon, 9 Feb 2015 12:26:18 -0500 Received: from resqmta-ch2-11v.sys.comcast.net (resqmta-ch2-11v.sys.comcast.net [69.252.207.43]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id t19HQFc2020407 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES128-SHA bits=128 verify=FAIL) for ; Mon, 9 Feb 2015 12:26:16 -0500 In-Reply-To: <20150209180058.54f930bd@ivy-bridge> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Steve Grubb Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com --===============2126377246526831628== Content-Type: multipart/alternative; boundary="----=_Part_2438458_409334003.1423502775407" ------=_Part_2438458_409334003.1423502775407 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Yeah, just crawled into the rpm and saw that. Going to try to re-spin a smaller RPM without the zos and see if that works. ----- Original Message ----- From: "Steve Grubb" To: salgak@comcast.net Cc: linux-audit@redhat.com Sent: Monday, February 9, 2015 12:00:58 PM Subject: Re: Audit: audisp-remote plugin: why is OpenLDAP a dependency ?? On Mon, 9 Feb 2015 13:47:36 +0000 (UTC) salgak@comcast.net wrote: > I'm currently dealing with a VMware appliance, and need to export my > audit logs. Despite VMware telling me to use the audisp-remote plugin > with auditd, I get a dependency check for OpenLDAP, and the install > fails. > > I'm pointing to my audit server (a Splunk box) via IP address. Is > there any workaround, or am I stuck adding even MORE software to the > appliance ?? The package the plugin is included in contains all of them. The zos-remote plugin is the one that wants openldap. -Steve ------=_Part_2438458_409334003.1423502775407 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable
Yeah, just crawled into the rpm and sa= w that.  Going to try to re-spin a smaller RPM without the zos and see= if that works.


From: "Steve Grub= b" <sgrubb@redhat.com>
To: salgak@comcast.net
Cc: linux-audit@redhat.com
Sent: Monday, February 9, 2015 12:00:58 P= M
Subject: Re: Audit: audisp-remote plugin: why is OpenLDAP a dep= endency ??

On Mon, 9 Feb 2015 13:47:36 +0000 (UTC)
sal= gak@comcast.net wrote:

> I'm currently dealing with a = VMware appliance, and need to export my
> audit logs. Despite VMware = telling me to use the audisp-remote plugin
> with auditd, I get a dep= endency check for OpenLDAP, and the install
> fails.
>
>= ; I'm pointing to my audit server (a Splunk box) via IP address. Is
>= there any workaround, or am I stuck adding even MORE software to the
&g= t; appliance ??

The package the plugin is included in co= ntains all of them. The
zos-remote plugin is the one that wants openldap= .

-Steve

------=_Part_2438458_409334003.1423502775407-- --===============2126377246526831628== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============2126377246526831628==-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: salgak@comcast.net Subject: Re: Audit: audisp-remote plugin: why is OpenLDAP a dependency ?? Date: Tue, 10 Feb 2015 19:01:27 +0000 (UTC) Message-ID: <285615815.3363270.1423594887279.JavaMail.zimbra@comcast.net> References: <924112195.2223087.1423489490422.JavaMail.zimbra@comcast.net> <473290240.2225092.1423489656934.JavaMail.zimbra@comcast.net> <20150209180058.54f930bd@ivy-bridge> <1286467080.2438459.1423502775408.JavaMail.zimbra@comcast.net> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============7327281000775502108==" Return-path: Received: from mx1.redhat.com (ext-mx11.extmail.prod.ext.phx2.redhat.com [10.5.110.16]) by int-mx10.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id t1AJ1VcI028420 for ; Tue, 10 Feb 2015 14:01:31 -0500 Received: from resqmta-ch2-02v.sys.comcast.net (resqmta-ch2-02v.sys.comcast.net [69.252.207.34]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id t1AJ1RmJ029344 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES128-SHA bits=128 verify=FAIL) for ; Tue, 10 Feb 2015 14:01:28 -0500 In-Reply-To: <1286467080.2438459.1423502775408.JavaMail.zimbra@comcast.net> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Steve Grubb Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com --===============7327281000775502108== Content-Type: multipart/alternative; boundary="----=_Part_3363269_347687786.1423594887278" ------=_Part_3363269_347687786.1423594887278 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit So, respin a new RPM using rpmrebuild, dropping the zos plugins ? i.e. the appropriate section of the SPEC would now look like this: Provides: audit-audispd-plugins = 1.8-0.28.1 #Requires: openldap2 #Requires: rpmlib(PayloadFilesHavePrefix) <= 4.0-1 #Requires: rpmlib(CompressedFileNames) <= 3.0.4-1 Requires: libaudit.so.0()(64bit) Requires: libauparse.so.0()(64bit) Requires: libc.so.6()(64bit) Requires: libc.so.6(GLIBC_2.2.5)(64bit) Requires: libc.so.6(GLIBC_2.3)(64bit) Requires: libc.so.6(GLIBC_2.3.4)(64bit) Requires: libc.so.6(GLIBC_2.4)(64bit) Requires: libc.so.6(GLIBC_2.8)(64bit) #Requires: liblber-2.4.so.2()(64bit) #Requires: libldap-2.4.so.2()(64bit) Requires: libpthread.so.0()(64bit) Requires: libpthread.so.0(GLIBC_2.2.5)(64bit) Requires: libpthread.so.0(GLIBC_2.3.2)(64bit) #Requires: rpmlib(PayloadIsLzma) <= 4.4.6-1 #suggest #enhance %description The audit-audispd-plugins package contains plugin components for the audit dispatcher (audispd). Authors: -------- Steve Grubb %files %config(noreplace) %attr(0640, root, root) "/etc/audisp/audisp-remote.conf" %config(noreplace) %attr(0640, root, root) "/etc/audisp/plugins.d/au-remote.conf" #%config(noreplace) %attr(0640, root, root) "/etc/audisp/plugins.d/audispd-zos-remote.conf" #%config(noreplace) %attr(0640, root, root) "/etc/audisp/zos-remote.conf" %attr(0750, root, root) "/usr/sbin/audisp-remote" #%attr(0750, root, root) "/usr/sbin/audispd-zos-remote" %doc %attr(0644, root, root) "/usr/share/man/man5/audisp-remote.conf.5.gz" #%doc %attr(0644, root, root) "/usr/share/man/man5/zos-remote.conf.5.gz" %doc %attr(0644, root, root) "/usr/share/man/man8/audisp-remote.8.gz" #%doc %attr(0644, root, root) "/usr/share/man/man8/audispd-zos-remote.8.gz" ----- Original Message ----- From: salgak@comcast.net To: "Steve Grubb" Cc: linux-audit@redhat.com Sent: Monday, February 9, 2015 12:26:15 PM Subject: Re: Audit: audisp-remote plugin: why is OpenLDAP a dependency ?? Yeah, just crawled into the rpm and saw that. Going to try to re-spin a smaller RPM without the zos and see if that works. ----- Original Message ----- From: "Steve Grubb" To: salgak@comcast.net Cc: linux-audit@redhat.com Sent: Monday, February 9, 2015 12:00:58 PM Subject: Re: Audit: audisp-remote plugin: why is OpenLDAP a dependency ?? On Mon, 9 Feb 2015 13:47:36 +0000 (UTC) salgak@comcast.net wrote: > I'm currently dealing with a VMware appliance, and need to export my > audit logs. Despite VMware telling me to use the audisp-remote plugin > with auditd, I get a dependency check for OpenLDAP, and the install > fails. > > I'm pointing to my audit server (a Splunk box) via IP address. Is > there any workaround, or am I stuck adding even MORE software to the > appliance ?? The package the plugin is included in contains all of them. The zos-remote plugin is the one that wants openldap. -Steve ------=_Part_3363269_347687786.1423594887278 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable
So, respin a new RPM using rpmrebuild,= dropping the zos plugins ?

i.e. the appropriate section of the SPEC= would now look like this:


Provides:   &n= bsp;  audit-audispd-plugins =3D 1.8-0.28.1
#Requir= es:      openldap2
#Requires:&= nbsp;     rpmlib(PayloadFilesHavePrefix) <=3D 4.0-1<= /strong>
#Requires:      rpmlib(Compres= sedFileNames) <=3D 3.0.4-1
Requires:  &nbs= p;   libaudit.so.0()(64bit)
Requires: &n= bsp;    libauparse.so.0()(64bit)
Require= s:      libc.so.6()(64bit)
Req= uires:      libc.so.6(GLIBC_2.2.5)(64bit)=
Requires:      libc.so.6(GLIBC_2.3)(64= bit)
Requires:      libc.so.6(= GLIBC_2.3.4)(64bit)
Requires:    &n= bsp; libc.so.6(GLIBC_2.4)(64bit)
Requires:  &= nbsp;   libc.so.6(GLIBC_2.8)(64bit)
#Requires= :      liblber-2.4.so.2()(64bit)
#Requires:      libldap-2.4.so.2()(64bit)
Requires:      libpthread.so.0()(64= bit)
Requires:      libpthread= .so.0(GLIBC_2.2.5)(64bit)
Requires:   &n= bsp;  libpthread.so.0(GLIBC_2.3.2)(64bit)
#Require= s:      rpmlib(PayloadIsLzma) <=3D 4.4.6-1
#suggest
#enhance
%= description
The audit-audispd-plugins package contains = plugin components for the
audit dispatcher (audispd).



Authors:
--------
    Steve Grubb <sgrubb@redhat.com>
%files
%config(noreplace) %attr(0640, r= oot, root) "/etc/audisp/audisp-remote.conf"
%config(nor= eplace) %attr(0640, root, root) "/etc/audisp/plugins.d/au-remote.conf"
#%config(noreplace) %attr(0640, root, root) "/etc/audisp/pl= ugins.d/audispd-zos-remote.conf"
#%config(noreplace) %a= ttr(0640, root, root) "/etc/audisp/zos-remote.conf"
%at= tr(0750, root, root) "/usr/sbin/audisp-remote"
#%attr(0= 750, root, root) "/usr/sbin/audispd-zos-remote"
%doc %a= ttr(0644, root, root) "/usr/share/man/man5/audisp-remote.conf.5.gz"
#%doc %attr(0644, root, root) "/usr/share/man/man5/zos-remote.= conf.5.gz"
%doc %attr(0644, root, root) "/usr/share/man= /man8/audisp-remote.8.gz"
#%doc %attr(0644, root, root)= "/usr/share/man/man8/audispd-zos-remote.8.gz"

<= /div>
From: salgak@comcast.net
To: "Steve Grubb" = <sgrubb@redhat.com>
Cc: linux-audit@redhat.com
Sent: = Monday, February 9, 2015 12:26:15 PM
Subject: Re: Audit: audi= sp-remote plugin: why is OpenLDAP a dependency ??

Yeah, just c= rawled into the rpm and saw that.  Going to try to re-spin a smaller R= PM without the zos and see if that works.


From: "Steve Grubb" <sgrubb@redhat.com>
To: salg= ak@comcast.net
Cc: linux-audit@redhat.com
Sent: Monday,= February 9, 2015 12:00:58 PM
Subject: Re: Audit: audisp-remote p= lugin: why is OpenLDAP a dependency ??

On Mon, 9 Feb 2015= 13:47:36 +0000 (UTC)
salgak@comcast.net wrote:

> I= 'm currently dealing with a VMware appliance, and need to export my
>= audit logs. Despite VMware telling me to use the audisp-remote plugin
&= gt; with auditd, I get a dependency check for OpenLDAP, and the install
= > fails.
>
> I'm pointing to my audit server (a Splunk box= ) via IP address. Is
> there any workaround, or am I stuck adding eve= n MORE software to the
> appliance ??

The package = the plugin is included in contains all of them. The
zos-remote plugin is= the one that wants openldap.

-Steve


------=_Part_3363269_347687786.1423594887278-- --===============7327281000775502108== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============7327281000775502108==-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: Audit: audisp-remote plugin: why is OpenLDAP a dependency ?? Date: Thu, 12 Feb 2015 14:42:24 -0500 Message-ID: <158203247.f4u9RDS02R@x2> References: <924112195.2223087.1423489490422.JavaMail.zimbra@comcast.net> <1286467080.2438459.1423502775408.JavaMail.zimbra@comcast.net> <285615815.3363270.1423594887279.JavaMail.zimbra@comcast.net> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <285615815.3363270.1423594887279.JavaMail.zimbra@comcast.net> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: salgak@comcast.net Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Tuesday, February 10, 2015 07:01:27 PM salgak@comcast.net wrote: > So, respin a new RPM using rpmrebuild, dropping the zos plugins ? > > i.e. the appropriate section of the SPEC would now look like this: I'll see about making a configure switch to not build it, too. -Steve From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Keith A. Glass" Subject: RE: Audit: audisp-remote plugin: why is OpenLDAP a dependency ?? Date: Thu, 12 Feb 2015 17:22:58 -0500 Message-ID: <01f501d04712$74e9d7d0$5ebd8770$@net> References: <924112195.2223087.1423489490422.JavaMail.zimbra@comcast.net> <1286467080.2438459.1423502775408.JavaMail.zimbra@comcast.net> <285615815.3363270.1423594887279.JavaMail.zimbra@comcast.net> <158203247.f4u9RDS02R@x2> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from mx1.redhat.com (ext-mx16.extmail.prod.ext.phx2.redhat.com [10.5.110.21]) by int-mx11.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id t1CMN29j005390 for ; Thu, 12 Feb 2015 17:23:02 -0500 Received: from resqmta-ch2-04v.sys.comcast.net (resqmta-ch2-04v.sys.comcast.net [69.252.207.36]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id t1CMN02H019532 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES128-SHA bits=128 verify=FAIL) for ; Thu, 12 Feb 2015 17:23:01 -0500 In-Reply-To: <158203247.f4u9RDS02R@x2> Content-Language: en-us List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: 'Steve Grubb' Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com Actually, I was trying to do the re-spin, but it's been overcome by events, just shipping the output of auditd to /var/log/messages, and letting Splunk sort it all out. . . -----Original Message----- From: Steve Grubb [mailto:sgrubb@redhat.com] Sent: Thursday, February 12, 2015 2:42 PM To: salgak@comcast.net Cc: linux-audit@redhat.com Subject: Re: Audit: audisp-remote plugin: why is OpenLDAP a dependency ?? On Tuesday, February 10, 2015 07:01:27 PM salgak@comcast.net wrote: > So, respin a new RPM using rpmrebuild, dropping the zos plugins ? > > i.e. the appropriate section of the SPEC would now look like this: I'll see about making a configure switch to not build it, too. -Steve ----- No virus found in this message. Checked by AVG - www.avg.com Version: 2013.0.3495 / Virus Database: 4257/9101 - Release Date: 02/12/15