Linux Audit Framework question

Linux Audit Framework question

[Jan]

Hello,

I write you because i do not know how to go further without solving my problem.
When a user switches from username to root using sudo su - this action is audited by LAF but since that change the user-id in the LAF logfile is 0 for root user. If my user uses chmod afterwords to change file permissions i can not see which user did the change because user-id is 0 and the auditid is always 4294967295.
Can you tell me how it is possible to trace the user after switching to root ??


Thanks in advance,
Jan

Re: Linux Audit Framework question

[Steve Grubb]

On Wednesday, June 20, 2012 01:04:26 PM Jan wrote:
> Hello,
> 
> I write you because i do not know how to go further without solving my
> problem. When a user switches from username to root using sudo su - this
> action is audited by LAF but since that change the user-id in the LAF
> logfile is 0 for root user. If my user uses chmod afterwords to change file
> permissions i can not see which user did the change because user-id is 0
> and the auditid is always 4294967295. Can you tell me how it is possible to
> trace the user after switching to root ??

Its sounds like your entry point is missing the following pam line:

session    required     pam_loginuid.so

This sets the loginuid which is inherited by each process the user creates. 
So, if they get in by gdm, it needs to be in gdm's pam stack. If they get in 
by sshd, it needs to be there. Etc.

-Steve