Re: monitoring both logins and logouts via ssh in SLES10 SP1 RC2

Steve Grubb
2007-05-25T17:52:32Z

On Friday 25 May 2007 13:21, Michael Folsom wrote:
> Did a little test on a X86-64 SLES10 SP1 RC2 system - sshed into in
> and did see the USER_LOGIN line then got out via either an exit or
> logout and never see an USER_END statement.

If I remember correctly, there was a bug in a patch to sshd that called
pam_session_close from the unprivileged process. I think we moved this and
sent the patch upstream.

> Could this be an issue in Suse's implementation of audit?

There might be a sshd patch that needs backporting from openssh cvs.

-Steve