From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: passwd and USER_CHAUTHTOK Date: Wed, 30 Aug 2017 15:02:53 -0400 Message-ID: <1710054.zz21I9x0fd@x2> References: <3D2AB1326AB2974190FCE3F69401F7900102F2B4B976@FRVDX103.fr01.awl.atosorigin.net> <1814694.A4XjMbMWtj@x2> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <1814694.A4XjMbMWtj@x2> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com Cc: Maupertuis Philippe List-Id: linux-audit@redhat.com On Wednesday, August 30, 2017 10:22:43 AM EDT Steve Grubb wrote: > Hello Philippe, > > Thanks for reporting this (and the other bug which is in my queue to work > on). > On Wednesday, August 30, 2017 3:56:10 AM EDT Maupertuis Philippe wrote: > > Hi > > On a new redhat 7.4, passwd -S to check the status of a user generates the > > following event : node=xxxxx type=USER_CHAUTHTOK msg=audit(28/08/17 > > 16:34:18.632:54145) : pid=31134 uid=root auid=xxxxx ses=3866 > > msg='op=password status displayed for user id=ftp exe=/usr/bin/passwd > > hostname= xxxxx addr=? terminal=pts/1 res=success' > > > > According to > > https://github.com/linux-audit/audit-documentation/wiki/SPEC-User-Account- > > L > > ifecycle-Events USER_CHAUTHTOK means that the user has successfully > > changed his password. In that case no change were done, only a query as it > > appears in the msg field > > > > The text format is even more disturbing : > > On xxxxx at 16:34:18 28/08/17 xxxxx, acting as root, successfully > > changed-password using /usr/bin/passwd The real action and the target user > > (ftp) is entirely lost in the text format. > > > > I would say that this message should not have been generated in the first > > place. > > I would agree. I'll make a patch to remove it. In case anyone wants this update to passwd, it is here: https://pagure.io/passwd/c/c461efa0b6f9134adbb1440bb8cef2d3bf81620d?branch=master > I looked around the auditing in passwd and it looks like it has not been > updated as everything else has been to eliminate dangling text. So, it's > wholly unsuited as is for text format output. I'll make a second patch to > update the auditing to modern standards. Its probably not been touched in a > decade. And the other audit cleanups here: https://pagure.io/passwd/c/d02e152112b28717eece1d64027a325439968e9f?branch=master https://pagure.io/passwd/c/137db0d6f2fd668081133c172ae7726d28ce95b6?branch=master -Steve