From: Steve Grubb <sgrubb@redhat.com>
To: linux-audit@redhat.com
Cc: MS PRAVEEN <pms007@gmail.com>
Subject: Re: help- auditing sys admin commands
Date: Fri, 2 Dec 2011 08:48:37 -0500 [thread overview]
Message-ID: <201112020848.37509.sgrubb@redhat.com> (raw)
In-Reply-To: <CAGFgV70WFjLBQTqFC1b2Wf+zth_AscVzg4u6vQ3=U2yD-r14_g@mail.gmail.com>
On Thursday, December 01, 2011 10:12:48 PM MS PRAVEEN wrote:
> Can some body help me here to find a rule/ solution to audit only commands
> are its arguments executed by users and root . I dont need any more other
> events audited since that can fill my free space .
Well, the problem is how can you tell a command being executed from a script calling
various programs? Also how can you tell that a file being sourced is a command? (I
think in that case a file is opened for read and the shell executes it.) I think the
bottom line is its pretty hard to tell.
So, what we have is key stroke logging. This gets more than commands, but wouldn't you
want to log what people do if its that important? If someone knew that only commands
are being logged, they could start python and just start typing commands which won't
be otherwise logged. There is a man page for this, pam_tty_audit.
-Steve
prev parent reply other threads:[~2011-12-02 13:48 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-12-02 3:12 help- auditing sys admin commands MS PRAVEEN
2011-12-02 13:48 ` Steve Grubb [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=201112020848.37509.sgrubb@redhat.com \
--to=sgrubb@redhat.com \
--cc=linux-audit@redhat.com \
--cc=pms007@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox