From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: Auditing console access Date: Thu, 07 Sep 2017 14:23:09 -0400 Message-ID: <1824423.yrpARTuqXu@x2> References: <3D2AB1326AB2974190FCE3F69401F7900102F358B6BA@FRVDX103.fr01.awl.atosorigin.net> <1987898.q18JgGjdTj@x2> <3D2AB1326AB2974190FCE3F69401F7900102F358B764@FRVDX103.fr01.awl.atosorigin.net> Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Return-path: In-Reply-To: <3D2AB1326AB2974190FCE3F69401F7900102F358B764@FRVDX103.fr01.awl.atosorigin.net> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com Cc: Maupertuis Philippe List-Id: linux-audit@redhat.com On Thursday, September 7, 2017 4:04:39 AM EDT Maupertuis Philippe wrote: > > -----Original Message----- > > From: Steve Grubb [mailto:sgrubb@redhat.com] > > Sent: Wednesday, September 06, 2017 8:13 PM > > To: linux-audit@redhat.com > > Cc: Maupertuis Philippe > > Subject: Re: Auditing console access > > = > > On Wednesday, September 6, 2017 9:42:53 AM EDT Maupertuis Philippe > > = > > wrote: > > > Hi, > > > The examples found in the audit documentation mention that to work it > > > is assumed that no direct root login is allowed. This very sensible > > > and not a big problem except for console access. > > = > > Why is it a problem for console access? :-) > = > All people account are managed in a ldap, only root has a password and can > be used in last resort. The most obvious case in when something is wrong > with sssd, letting us with only local users. We could set up a local > account for that purpose but it wouldn't fit easily with PCI-DSS. > > > > What would be the best way to monitor what is done through this acces= s ? > = > Is there a way to get a specific information when this access is used ? > Maybe not all what was done but at least that someone used this entry. The aulast program gives you session information. If you tell it --proof, t= hen = it will give you the ausearch command to isolate the session's events. -Steve > > If you need to know the commands & changes made by root, then you > > probably need to use pam_tty_audit to enable tty auditing for su and su= do. > > = > > > Would you recommend to forbid root access even in console ? > > = > > Yes. Who is root? Who was root 4 years ago? By logging in with your > > account > > and then changing to root, the audit system can track who root is. The > > only > > time I can think of where you wouldn't want this tracking is when the > > system is in single user mode. (Because auditd doesn't normally start in > > single user mode.) > > = > > -Steve > > = > > = > > !!!******************************************************** > > *********** > > = > > > ****** > > > ************ "Ce message et les pi?ces jointes sont confidentiels et > > > r?serv?s ? l'usage exclusif de ses destinataires. Il peut ?galement > > > ?tre prot?g? par le secret professionnel. Si vous recevez ce message > > > par erreur, merci d'en avertir imm?diatement l'exp?diteur et de le > > > d?truire. L'int?grit? du message ne pouvant ?tre assur?e sur Internet, > > > la > > > responsabilit? de Worldline ne pourra ?tre recherch?e quant au contenu > > > de ce message. Bien que les meilleurs efforts soient faits pour > > > maintenir cette transmission exempte de tout virus, l'exp?diteur ne > > > donne aucune garantie ? cet ?gard et sa responsabilit? ne saurait ?tre > > > recherch?e pour tout dommage r?sultant d'un virus transmis. > > > = > > > This e-mail and the documents attached are confidential and intended > > > solely for the addressee; it may also be privileged. If you receive > > > this e-mail in error, please notify the sender immediately and destroy > > > it. As its integrity cannot be secured on the Internet, the Worldline > > > liability cannot be triggered for the message content. Although the > > > sender endeavours to maintain a computer virus-free network, the > > > sender does not warrant that this transmission is virus-free and will > > > not be liable for any damages resulting from any virus transmitted.!!= !" > = > !!!**********************************************************************= *** > ************ "Ce message et les pi=E8ces jointes sont confidentiels et > r=E9serv=E9s =E0 l'usage exclusif de ses destinataires. Il peut =E9galeme= nt =EAtre > prot=E9g=E9 par le secret professionnel. Si vous recevez ce message par e= rreur, > merci d'en avertir imm=E9diatement l'exp=E9diteur et de le d=E9truire. > L'int=E9grit=E9 du message ne pouvant =EAtre assur=E9e sur Internet, la > responsabilit=E9 de Worldline ne pourra =EAtre recherch=E9e quant au cont= enu de > ce message. Bien que les meilleurs efforts soient faits pour maintenir > cette transmission exempte de tout virus, l'exp=E9diteur ne donne aucune > garantie =E0 cet =E9gard et sa responsabilit=E9 ne saurait =EAtre recherc= h=E9e pour > tout dommage r=E9sultant d'un virus transmis. > = > This e-mail and the documents attached are confidential and intended sole= ly > for the addressee; it may also be privileged. If you receive this e-mail = in > error, please notify the sender immediately and destroy it. As its > integrity cannot be secured on the Internet, the Worldline liability cann= ot > be triggered for the message content. Although the sender endeavours to > maintain a computer virus-free network, the sender does not warrant that > this transmission is virus-free and will not be liable for any damages > resulting from any virus transmitted.!!!" > = > -- > Linux-audit mailing list > Linux-audit@redhat.com > https://www.redhat.com/mailman/listinfo/linux-audit