From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: Audit config for NISPOM req's Date: Tue, 16 Jan 2007 11:15:10 -0500 Message-ID: <200701161115.10977.sgrubb@redhat.com> References: <200612221033.23644.sgrubb@redhat.com> <200701121449.32200.sgrubb@redhat.com> <954E3479CC27224785179CA04904214D04A04964@0668-its-exmp01.us.saic.com> Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Return-path: In-Reply-To: <954E3479CC27224785179CA04904214D04A04964@0668-its-exmp01.us.saic.com> Content-Disposition: inline List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: "Kirkwood, David A." Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Tuesday 16 January 2007 10:51, Kirkwood, David A. wrote: > My pam.d directory shows: This all looks correct now. > I added > =A0xcreensaver session required pam_loginuid.so > but it had no effect. I wouldn't. xscreensaver runs as a common user and does not have the=20 capabilities needed to set the loginuid. > Is there anything else I missed? That should do it. The communication chain here is: login->pam->kernel kernel->auditd You should get a kernel event when you do this as root: echo 500 > /proc/self/loginuid ausearch -ts today -m LOGIN time->Tue Jan 16 11:11:43 2007 type=3DLOGIN msg=3Daudit(1168963903.962:1310): login pid=3D19065 uid=3D0 = old auid=3D500=20 new auid=3D500 If that's not working, you have a kernel problem. If its working, I'd loo= k at=20 pam/login. -Steve