From mboxrd@z Thu Jan  1 00:00:00 1970
From: Steve Grubb <sgrubb@redhat.com>
Subject: Re: [PATCH] auditd - TTY support for audisp-prelude
Date: Sat, 25 Jun 2011 10:55:12 -0400
Message-ID: <201106251055.12481.sgrubb@redhat.com>
References: <a6dd15a8-28a3-4397-832c-399df2efd19a@dbm01.intra.dbmsrl.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
In-Reply-To: <a6dd15a8-28a3-4397-832c-399df2efd19a@dbm01.intra.dbmsrl.com>
List-Unsubscribe: <https://www.redhat.com/mailman/options/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: linux-audit@redhat.com
List-Id: linux-audit@redhat.com

On Friday, June 17, 2011 11:10:41 AM Matteo Sessa wrote:
> Attached is a patch for auditd to add support for TTY audits (
> pam_tty_audit session module ) to audisp-prelude.
> 
> Alerts are reported with:
> alert.classification.text = "Keylogger"
> alert.assessment.impact.severity = LOW

Thanks for this contribution. I applied the patch with a couple minor revisions.


> and actual keystrokes carried on alert.additional_data.

Because of this ^^^ I am disabling it by default since I think you want to stop and 
consider if you really want keystrokes on your prelude database.


> Attached you will find also a basic python commandline script to query
> keylogger data from prelude database.

If there was a little more explanation of this script in its text, I would add it to 
the contrib section to preserve it.

Thanks,
-Steve