Authentication Events

Authentication Events

[Kevin Boyce]

[-- Attachment #1.1: Type: text/plain, Size: 358 bytes --]

Does anyone know if the auditd on RHEL4 is capable of capturing
logon/logoff and failed authentication events?  This seems to work
flawlessly without any additional changes on a RHEL5 system.
Would this just be a configuration change in the PAM stack to allow
auditd to get these events, rather than using syslog?

Any ideas would be helpful.

Thanks,
Kevin

[-- Attachment #1.2: Type: text/html, Size: 618 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]

Re: Authentication Events

[Steve Grubb]

On Wednesday 14 January 2009 01:11:02 pm Kevin Boyce wrote:
> Does anyone know if the auditd on RHEL4 is capable of capturing
> logon/logoff and failed authentication events?

The logon/off events should be there as of update 2. But they were improved to 
meet NISPOM in Update 3. They are hardwired into pam and you should not have 
to do anything except use a version of pam from Update 2 or later.

> Would this just be a configuration change in the PAM stack to allow
> auditd to get these events, rather than using syslog?

No changes are needed unless you want to add pam_tally2.

-Steve