AUDIT_LOGIN vs AUDIT_USER

Linux-audit Archive on lore.kernel.org
 help / color / mirror / Atom feed

* AUDIT_LOGIN vs AUDIT_USER_LOGIN
@ 2015-07-31 13:59 Satish Chandra Kilaru
  2015-07-31 14:12 ` Satish Chandra Kilaru
  2015-07-31 14:19 ` Steve Grubb
  0 siblings, 2 replies; 4+ messages in thread
From: Satish Chandra Kilaru @ 2015-07-31 13:59 UTC (permalink / raw)
  To: linux-audit@redhat.com


[-- Attachment #1.1: Type: text/plain, Size: 136 bytes --]

I see AUDIT_USER_LOGIN when I ssh to a linux machine. What action will
cause AUDIT_LOGIN  event?

--
Please Donate to www.wikipedia.org

[-- Attachment #1.2: Type: text/html, Size: 313 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]



^ permalink raw reply	[flat|nested] 4+ messages in thread

* Re: AUDIT_LOGIN vs AUDIT_USER_LOGIN
  2015-07-31 13:59 AUDIT_LOGIN vs AUDIT_USER_LOGIN Satish Chandra Kilaru
@ 2015-07-31 14:12 ` Satish Chandra Kilaru
  2015-07-31 14:19 ` Steve Grubb
  1 sibling, 0 replies; 4+ messages in thread
From: Satish Chandra Kilaru @ 2015-07-31 14:12 UTC (permalink / raw)
  To: linux-audit@redhat.com


[-- Attachment #1.1: Type: text/plain, Size: 423 bytes --]

It just means Audit Login Context is set...

http://lxr.free-electrons.com/source/kernel/auditsc.c#L1991

I actually see that event when I ssh.

On Fri, Jul 31, 2015 at 9:59 AM, Satish Chandra Kilaru <iam.kilaru@gmail.com
> wrote:

>
> I see AUDIT_USER_LOGIN when I ssh to a linux machine. What action will
> cause AUDIT_LOGIN  event?
>
> --
> Please Donate to www.wikipedia.org
>



-- 
Please Donate to www.wikipedia.org

[-- Attachment #1.2: Type: text/html, Size: 1105 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]



^ permalink raw reply	[flat|nested] 4+ messages in thread

* Re: AUDIT_LOGIN vs AUDIT_USER_LOGIN
  2015-07-31 13:59 AUDIT_LOGIN vs AUDIT_USER_LOGIN Satish Chandra Kilaru
  2015-07-31 14:12 ` Satish Chandra Kilaru
@ 2015-07-31 14:19 ` Steve Grubb
  2015-07-31 14:20   ` Satish Chandra Kilaru
  1 sibling, 1 reply; 4+ messages in thread
From: Steve Grubb @ 2015-07-31 14:19 UTC (permalink / raw)
  To: linux-audit

On Friday, July 31, 2015 09:59:13 AM Satish Chandra Kilaru wrote:
> I see AUDIT_USER_LOGIN when I ssh to a linux machine. 

This means an interactive login session has been started by the user. This is 
in contract to a cron job which does not create this event.

> What action will cause AUDIT_LOGIN  event?

This means that the loginuid was set. Even a cron job will do this.

-Steve

^ permalink raw reply	[flat|nested] 4+ messages in thread

* Re: AUDIT_LOGIN vs AUDIT_USER_LOGIN
  2015-07-31 14:19 ` Steve Grubb
@ 2015-07-31 14:20   ` Satish Chandra Kilaru
  0 siblings, 0 replies; 4+ messages in thread
From: Satish Chandra Kilaru @ 2015-07-31 14:20 UTC (permalink / raw)
  To: Steve Grubb; +Cc: linux-audit@redhat.com


[-- Attachment #1.1: Type: text/plain, Size: 535 bytes --]

Thank you.

On Fri, Jul 31, 2015 at 10:19 AM, Steve Grubb <sgrubb@redhat.com> wrote:

> On Friday, July 31, 2015 09:59:13 AM Satish Chandra Kilaru wrote:
> > I see AUDIT_USER_LOGIN when I ssh to a linux machine.
>
> This means an interactive login session has been started by the user. This
> is
> in contract to a cron job which does not create this event.
>
> > What action will cause AUDIT_LOGIN  event?
>
> This means that the loginuid was set. Even a cron job will do this.
>
> -Steve
>
>


-- 
Please Donate to www.wikipedia.org

[-- Attachment #1.2: Type: text/html, Size: 1095 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]



^ permalink raw reply	[flat|nested] 4+ messages in thread

end of thread, other threads:[~2015-07-31 14:20 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2015-07-31 13:59 AUDIT_LOGIN vs AUDIT_USER_LOGIN Satish Chandra Kilaru
2015-07-31 14:12 ` Satish Chandra Kilaru
2015-07-31 14:19 ` Steve Grubb
2015-07-31 14:20   ` Satish Chandra Kilaru

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox