From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: openssh logout not being audited on fc5 Date: Wed, 5 Nov 2008 15:34:23 -0500 Message-ID: <200811051534.23967.sgrubb@redhat.com> References: <54FBB3490A6F3249BFA660814E9114EB9221410CD4@aplesstripe.dom1.jhuapl.edu> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <54FBB3490A6F3249BFA660814E9114EB9221410CD4@aplesstripe.dom1.jhuapl.edu> Content-Disposition: inline List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com Cc: "Wieprecht, Karen M." List-Id: linux-audit@redhat.com On Wednesday 05 November 2008 15:20:23 Wieprecht, Karen M. wrote: > Unfortunately, ssh logout isn't showing up in my audit logs, and although I > have an idea why, I can't seem to find what I think I need ... The system I > am building has the following: FC-5 is so long ago that I don't remember the problem. The audit packages are sort of tuned to go with the kernel of that era, so I don't know if you can take the audit package from FC-6 and use it on FC-5. But as for openssh, you can possibly try the FC-6 package here: http://archives.fedoraproject.org/pub/archive/fedora/linux/core/updates/6/SRPMS/openssh-4.3p2-25.fc6.src.rpm > OS = FC5 > audit subsystem = 1.3-2 > openssh = 4.3p2-4.12 > kernel = 2.6.20-1.2320-fc5 I believe this should have worked. Anyways maybe the newer openssh package does it. -Steve