Audit: audisp-remote plugin: why is OpenLDAP a dependency ??

Audit: audisp-remote plugin: why is OpenLDAP a dependency ??

[salgak]

[-- Attachment #1.1: Type: text/plain, Size: 766 bytes --]

I'm currently dealing with a VMware appliance, and need to export my audit logs. Despite VMware telling me to use the audisp-remote plugin with auditd, I get a dependency check for OpenLDAP, and the install fails. 

I'm pointing to my audit server (a Splunk box) via IP address. Is there any workaround, or am I stuck adding even MORE software to the appliance ?? 

______________________________________________________________________________________ 
It is by Caffeine alone, that I set my Mind in Motion. 
It is by the Beans of Java that thought acquires speed, the hands develop shakes, the shakes become a warning. 
It is by Caffeine alone that I set my Mind in Motion. 
______________________________________________________________________________________ 


[-- Attachment #1.2: Type: text/html, Size: 1085 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]

Re: Audit: audisp-remote plugin: why is OpenLDAP a dependency ??

[Steve Grubb]

On Mon, 9 Feb 2015 13:47:36 +0000 (UTC)
salgak@comcast.net wrote:

> I'm currently dealing with a VMware appliance, and need to export my
> audit logs. Despite VMware telling me to use the audisp-remote plugin
> with auditd, I get a dependency check for OpenLDAP, and the install
> fails. 
> 
> I'm pointing to my audit server (a Splunk box) via IP address. Is
> there any workaround, or am I stuck adding even MORE software to the
> appliance ?? 

The package the plugin is included in contains all of them. The
zos-remote plugin is the one that wants openldap.

-Steve

Re: Audit: audisp-remote plugin: why is OpenLDAP a dependency ??

[salgak]

[-- Attachment #1.1: Type: text/plain, Size: 950 bytes --]

Yeah, just crawled into the rpm and saw that. Going to try to re-spin a smaller RPM without the zos and see if that works. 

----- Original Message -----

From: "Steve Grubb" <sgrubb@redhat.com> 
To: salgak@comcast.net 
Cc: linux-audit@redhat.com 
Sent: Monday, February 9, 2015 12:00:58 PM 
Subject: Re: Audit: audisp-remote plugin: why is OpenLDAP a dependency ?? 

On Mon, 9 Feb 2015 13:47:36 +0000 (UTC) 
salgak@comcast.net wrote: 

> I'm currently dealing with a VMware appliance, and need to export my 
> audit logs. Despite VMware telling me to use the audisp-remote plugin 
> with auditd, I get a dependency check for OpenLDAP, and the install 
> fails. 
> 
> I'm pointing to my audit server (a Splunk box) via IP address. Is 
> there any workaround, or am I stuck adding even MORE software to the 
> appliance ?? 

The package the plugin is included in contains all of them. The 
zos-remote plugin is the one that wants openldap. 

-Steve 


[-- Attachment #1.2: Type: text/html, Size: 1561 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]

Re: Audit: audisp-remote plugin: why is OpenLDAP a dependency ??

[salgak]

[-- Attachment #1.1: Type: text/plain, Size: 2985 bytes --]

So, respin a new RPM using rpmrebuild, dropping the zos plugins ? 

i.e. the appropriate section of the SPEC would now look like this: 


Provides: audit-audispd-plugins = 1.8-0.28.1 
#Requires: openldap2 
#Requires: rpmlib(PayloadFilesHavePrefix) <= 4.0-1 
#Requires: rpmlib(CompressedFileNames) <= 3.0.4-1 
Requires: libaudit.so.0()(64bit) 
Requires: libauparse.so.0()(64bit) 
Requires: libc.so.6()(64bit) 
Requires: libc.so.6(GLIBC_2.2.5)(64bit) 
Requires: libc.so.6(GLIBC_2.3)(64bit) 
Requires: libc.so.6(GLIBC_2.3.4)(64bit) 
Requires: libc.so.6(GLIBC_2.4)(64bit) 
Requires: libc.so.6(GLIBC_2.8)(64bit) 
#Requires: liblber-2.4.so.2()(64bit) 
#Requires: libldap-2.4.so.2()(64bit) 
Requires: libpthread.so.0()(64bit) 
Requires: libpthread.so.0(GLIBC_2.2.5)(64bit) 
Requires: libpthread.so.0(GLIBC_2.3.2)(64bit) 
#Requires: rpmlib(PayloadIsLzma) <= 4.4.6-1 
#suggest 
#enhance 
%description 
The audit-audispd-plugins package contains plugin components for the 
audit dispatcher (audispd). 



Authors: 
-------- 
Steve Grubb <sgrubb@redhat.com> 
%files 
%config(noreplace) %attr(0640, root, root) "/etc/audisp/audisp-remote.conf" 
%config(noreplace) %attr(0640, root, root) "/etc/audisp/plugins.d/au-remote.conf" 
#%config(noreplace) %attr(0640, root, root) "/etc/audisp/plugins.d/audispd-zos-remote.conf" 
#%config(noreplace) %attr(0640, root, root) "/etc/audisp/zos-remote.conf" 
%attr(0750, root, root) "/usr/sbin/audisp-remote" 
#%attr(0750, root, root) "/usr/sbin/audispd-zos-remote" 
%doc %attr(0644, root, root) "/usr/share/man/man5/audisp-remote.conf.5.gz" 
#%doc %attr(0644, root, root) "/usr/share/man/man5/zos-remote.conf.5.gz" 
%doc %attr(0644, root, root) "/usr/share/man/man8/audisp-remote.8.gz" 
#%doc %attr(0644, root, root) "/usr/share/man/man8/audispd-zos-remote.8.gz" 

----- Original Message -----

From: salgak@comcast.net 
To: "Steve Grubb" <sgrubb@redhat.com> 
Cc: linux-audit@redhat.com 
Sent: Monday, February 9, 2015 12:26:15 PM 
Subject: Re: Audit: audisp-remote plugin: why is OpenLDAP a dependency ?? 

Yeah, just crawled into the rpm and saw that. Going to try to re-spin a smaller RPM without the zos and see if that works. 

----- Original Message -----

From: "Steve Grubb" <sgrubb@redhat.com> 
To: salgak@comcast.net 
Cc: linux-audit@redhat.com 
Sent: Monday, February 9, 2015 12:00:58 PM 
Subject: Re: Audit: audisp-remote plugin: why is OpenLDAP a dependency ?? 

On Mon, 9 Feb 2015 13:47:36 +0000 (UTC) 
salgak@comcast.net wrote: 

> I'm currently dealing with a VMware appliance, and need to export my 
> audit logs. Despite VMware telling me to use the audisp-remote plugin 
> with auditd, I get a dependency check for OpenLDAP, and the install 
> fails. 
> 
> I'm pointing to my audit server (a Splunk box) via IP address. Is 
> there any workaround, or am I stuck adding even MORE software to the 
> appliance ?? 

The package the plugin is included in contains all of them. The 
zos-remote plugin is the one that wants openldap. 

-Steve 



[-- Attachment #1.2: Type: text/html, Size: 5420 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]

Re: Audit: audisp-remote plugin: why is OpenLDAP a dependency ??

[Steve Grubb]

On Tuesday, February 10, 2015 07:01:27 PM salgak@comcast.net wrote:
> So, respin a new RPM using rpmrebuild, dropping the zos plugins ? 
> 
> i.e. the appropriate section of the SPEC would now look like this: 

I'll see about making a configure switch to not build it, too.

-Steve

RE: Audit: audisp-remote plugin: why is OpenLDAP a dependency ??

[Keith A. Glass]

Actually, I was trying to do the re-spin, but it's been overcome by events,
just shipping the output of auditd to /var/log/messages, and letting Splunk
sort it all out. . . 

-----Original Message-----
From: Steve Grubb [mailto:sgrubb@redhat.com] 
Sent: Thursday, February 12, 2015 2:42 PM
To: salgak@comcast.net
Cc: linux-audit@redhat.com
Subject: Re: Audit: audisp-remote plugin: why is OpenLDAP a dependency ??

On Tuesday, February 10, 2015 07:01:27 PM salgak@comcast.net wrote:
> So, respin a new RPM using rpmrebuild, dropping the zos plugins ? 
> 
> i.e. the appropriate section of the SPEC would now look like this: 

I'll see about making a configure switch to not build it, too.

-Steve
-----
No virus found in this message.
Checked by AVG - www.avg.com
Version: 2013.0.3495 / Virus Database: 4257/9101 - Release Date: 02/12/15