From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: Audit config for NISPOM req's Date: Fri, 12 Jan 2007 11:38:31 -0500 Message-ID: <200701121138.31139.sgrubb@redhat.com> References: <200612221033.23644.sgrubb@redhat.com> <954E3479CC27224785179CA04904214D04A041CF@0668-its-exmp01.us.saic.com> Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <954E3479CC27224785179CA04904214D04A041CF@0668-its-exmp01.us.saic.com> Content-Disposition: inline List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com Cc: "Kirkwood, David A." List-Id: linux-audit@redhat.com On Friday 12 January 2007 11:09, Kirkwood, David A. wrote: > I'm using RHEL4U4 and do not have autail. Where'd it come from? http://www.redhat.com/archives/linux-audit/2006-October/msg00035.html > Also, the doc I have does not metion the -rwxa option for watches. That was a typo. It should have been -p rwxa. It should be in auditctl man page. > Separate question. With the watches I have enabled, I never am able to > tie a user to an access violation. How do I do that? It should be done automatically. The auid is the field that you would look at. We've configured the pam settings for sshd,login,gdm, cron,vsftpd,remote to include the pam_loginuid.so module. This is needed for it to work. Unless you changed them, it should be setup at installation. -Steve