From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: RHEL 5 audit events Date: Tue, 21 Aug 2007 10:09:20 -0400 Message-ID: <200708211009.21227.sgrubb@redhat.com> References: <6F2A8C9C4C5BE446A17B745BBC856EEB5A6D27@XMBTX113.northgrum.com> <6F2A8C9C4C5BE446A17B745BBC856EEB5A6D28@XMBTX113.northgrum.com> <200708210952.04506.sgrubb@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Return-path: Received: from vpn-14-163.rdu.redhat.com (vpn-14-163.rdu.redhat.com [10.11.14.163]) by mail.boston.redhat.com (8.13.1/8.13.1) with ESMTP id l7LE9Mac003612 for ; Tue, 21 Aug 2007 10:09:23 -0400 In-Reply-To: <200708210952.04506.sgrubb@redhat.com> Content-Disposition: inline List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Tuesday 21 August 2007 09:52:03 Steve Grubb wrote: > > 1. su - "non_existent_account". Using the nispom.rules provided by > > audit 1.5.6-1. Using various ausearch parameters, am unable to find a > > corresponding failure when attempting to "su" to a non-existent > > account. On second thought...you were asking about su. This app has not been patched for auditing...although I think it should be. In the meantime, you can put a watch on the app: -w /bin/su -p x -k su-used [sgrubb src]$ su - badacct su: user badacct does not exist [root ~]# ausearch --start recent -k su-used -i ---- type=PATH msg=audit(08/21/2007 10:06:49.166:382) : item=1 name=(null) inode=13107250 dev=08:08 mode=file,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:ld_so_t:s0 type=PATH msg=audit(08/21/2007 10:06:49.166:382) : item=0 name=/bin/su inode=24641546 dev=08:08 mode=file,suid,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:su_exec_t:s0 type=CWD msg=audit(08/21/2007 10:06:49.166:382) : cwd=/home/sgrubb/working/BUILD/coreutils-5.97/src type=EXECVE msg=audit(08/21/2007 10:06:49.166:382) : a0="su" a1="-" a2="badacct" type=SYSCALL msg=audit(08/21/2007 10:06:49.166:382) : arch=x86_64 syscall=execve success=yes exit=0 a0=18172cd0 a1=18186460 a2=18192880 a3=8 items=2 ppid=6092 pid=6443 auid=sgrubb uid=sgrubb gid=sgrubb euid=root suid=root fsuid=root egid=sgrubb sgid=sgrubb fsgid=sgrubb tty=pts1 comm=su exe=/bin/su subj=user_u:system_r:unconfined_t:s0 key="su-used" Hope this helps.... -Steve