Re: Auditing console access

[Steve Grubb <sgrubb@redhat.com>]

On Thursday, September 7, 2017 4:04:39 AM EDT Maupertuis Philippe wrote:
> > -----Original Message-----
> > From: Steve Grubb [mailto:sgrubb@redhat.com]
> > Sent: Wednesday, September 06, 2017 8:13 PM
> > To: linux-audit@redhat.com
> > Cc: Maupertuis Philippe
> > Subject: Re: Auditing console access
> > 
> > On Wednesday, September 6, 2017 9:42:53 AM EDT Maupertuis Philippe
> > 
> > wrote:
> > > Hi,
> > > The examples found in the audit documentation mention that to work it
> > > is assumed that no direct root login is allowed. This very sensible
> > > and not a big problem except for console access.
> > 
> > Why is it a problem for console access?  :-)
> 
> All people account are managed in a ldap, only root has a password and can
> be used  in last resort. The most obvious case in when something is wrong
> with sssd, letting us with only local users. We could set up a local
> account for that purpose but it wouldn't fit easily with PCI-DSS.
>
> > > What would be the best way to monitor what is done through this access ?
> 
> Is there a way to get a specific information when this access is used ?
> Maybe not all what was done but at least that someone used this entry.

The aulast program gives you session information. If you tell it --proof, then 
it will give you the ausearch command to isolate the session's events.

-Steve

> > If you need to know the commands & changes made by root, then you
> > probably need to use pam_tty_audit to enable tty auditing for su and sudo.
> > 
> > > Would you recommend to forbid root access even in console ?
> > 
> > Yes. Who is root? Who was root 4 years ago? By logging in with your
> > account
> > and then changing to root, the audit system can track who root is. The
> > only
> > time I can think of where you wouldn't want this tracking is when the
> > system is in single user mode. (Because auditd doesn't normally start in
> > single user mode.)
> > 
> > -Steve
> > 
> > 
> > !!!********************************************************
> > ***********
> > 
> > > ******
> > > ************ "Ce message et les pi?ces jointes sont confidentiels et
> > > r?serv?s ? l'usage exclusif de ses destinataires. Il peut ?galement
> > > ?tre prot?g? par le secret professionnel. Si vous recevez ce message
> > > par erreur, merci d'en avertir imm?diatement l'exp?diteur et de le
> > > d?truire. L'int?grit? du message ne pouvant ?tre assur?e sur Internet,
> > > la
> > > responsabilit? de Worldline ne pourra ?tre recherch?e quant au contenu
> > > de ce message. Bien que les meilleurs efforts soient faits pour
> > > maintenir cette transmission exempte de tout virus, l'exp?diteur ne
> > > donne aucune garantie ? cet ?gard et sa responsabilit? ne saurait ?tre
> > > recherch?e pour tout dommage r?sultant d'un virus transmis.
> > > 
> > > This e-mail and the documents attached are confidential and intended
> > > solely for the addressee; it may also be privileged. If you receive
> > > this e-mail in error, please notify the sender immediately and destroy
> > > it. As its integrity cannot be secured on the Internet, the Worldline
> > > liability cannot be triggered for the message content. Although the
> > > sender endeavours to maintain a computer virus-free network, the
> > > sender does not warrant that this transmission is virus-free and will
> > > not be liable for any damages resulting from any virus transmitted.!!!"
> 
> !!!*************************************************************************
> ************ "Ce message et les pièces jointes sont confidentiels et
> réservés à l'usage exclusif de ses destinataires. Il peut également être
> protégé par le secret professionnel. Si vous recevez ce message par erreur,
> merci d'en avertir immédiatement l'expéditeur et de le détruire.
> L'intégrité du message ne pouvant être assurée sur Internet, la
> responsabilité de Worldline ne pourra être recherchée quant au contenu de
> ce message. Bien que les meilleurs efforts soient faits pour maintenir
> cette transmission exempte de tout virus, l'expéditeur ne donne aucune
> garantie à cet égard et sa responsabilité ne saurait être recherchée pour
> tout dommage résultant d'un virus transmis.
> 
> This e-mail and the documents attached are confidential and intended solely
> for the addressee; it may also be privileged. If you receive this e-mail in
> error, please notify the sender immediately and destroy it. As its
> integrity cannot be secured on the Internet, the Worldline liability cannot
> be triggered for the message content. Although the sender endeavours to
> maintain a computer virus-free network, the sender does not warrant that
> this transmission is virus-free and will not be liable for any damages
> resulting from any virus transmitted.!!!"
> 
> --
> Linux-audit mailing list
> Linux-audit@redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit