How can I install the latest version of Linux Audit on CentOS 6.8?

How can I install the latest version of Linux Audit on CentOS 6.8?

[Mateusz Piotrowski]

[-- Attachment #1.1: Type: text/plain, Size: 1777 bytes --]

Hello,

I’m trying to update the 2013 version of auditd on a just installed CentOS 6.8-i386. 

So far I’ve downloaded audit-userspace from GitHub[1] and I’ve faced a couple of problems:

1. README says that I should consult the README-install file. I cannot see this file. Where is it?
2. I consulted the INSTALL.tmp and since I’ve not got any ./configure file inside my clone I deducted I’ve got to run ./autogen.sh. I was missing some dependencies so I ran `yum install autoconf automake libtool`.
 
 Then I ran `./configure --sbindir=/sbin --with-python=yes --with-libwrap --enable-gssapi-krb5=yes --with-libcap-ng=yes` but the command failed at this is a part of the log I got (the full log file is available here[2]):

    configure: WARNING: unrecognized options: --with-libcap-ng
    ...
    Checking for programs
    ...
    ./configure: line 13130: AX_PROG_CC_FOR_BUILD: command not found
    ...
    Checking for header files
    ...
    checking for python... /usr/bin/python
    checking for python version... 2.6
    checking for python platform... linux2
    checking for python script directory... ${prefix}/lib/python2.6/site-packages
    checking for python extension module directory... ${exec_prefix}/lib/python2.6/site-packages
    configure: error: Python explicitly requested and python headers were not found

 Have you got any idea what the problem is?


Is there an easier way to get the latest Linux Audit version on my system?

Cheers! 

-m

[1]: https://github.com/linux-audit/audit-userspace <https://github.com/linux-audit/audit-userspace>
[2]: http://pastebin.com/jd7ZSmLV <http://pastebin.com/jd7ZSmLV>
[Logs in a raw txt format]: http://pastebin.com/raw/Jd7ZSmLV <http://pastebin.com/raw/Jd7ZSmLV>

[-- Attachment #1.2: Type: text/html, Size: 3046 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]

Re: How can I install the latest version of Linux Audit on CentOS 6.8?

[Steve Grubb]

On Friday, July 15, 2016 2:52:02 PM EDT Mateusz Piotrowski wrote:
> I’m trying to update the 2013 version of auditd on a just installed CentOS
> 6.8-i386.
>
> So far I’ve downloaded audit-userspace from GitHub[1] and I’ve faced a
> couple of problems:
> 
> 1. README says that I should consult the README-install file. I cannot see
> this file. Where is it? 2. I consulted the INSTALL.tmp and since I’ve not
> got any ./configure file inside my clone I deducted I’ve got to run
> ./autogen.sh. I was missing some dependencies so I ran `yum install
> autoconf automake libtool`.
> 
>  Then I ran `./configure --sbindir=/sbin --with-python=yes --with-libwrap
> --enable-gssapi-krb5=yes --with-libcap-ng=yes` but the command failed at
> this is a part of the log I got (the full log file is available here[2]):
> 
>     configure: WARNING: unrecognized options: --with-libcap-ng
>     ...
>     Checking for programs
>     ...
>     ./configure: line 13130: AX_PROG_CC_FOR_BUILD: command not found
>     ...
>     Checking for header files
>     ...
>     checking for python... /usr/bin/python
>     checking for python version... 2.6
>     checking for python platform... linux2
>     checking for python script directory...
> ${prefix}/lib/python2.6/site-packages checking for python extension module
> directory... ${exec_prefix}/lib/python2.6/site-packages configure: error:
> Python explicitly requested and python headers were not found
> 
>  Have you got any idea what the problem is?

Probably missing dependencies that would have been detected by building from a 
spec file.
 
> Is there an easier way to get the latest Linux Audit version on my system?

Why wouldn't you start with the distribution tar file?

http://people.redhat.com/sgrubb/audit/audit-2.6.5.tar.gz

If you are creating a distributable tar file for compilation, that would assume 
that you already had all dependencies solved on your system. The distributable 
tar file above was created on a system with all dependencies solved and the 
latest auto tools so that platforms are correctly detected.

If you want it packaged, then start with the Centos 6.8 spec file and adjust 
accordingly. The spec file shipped is aimed at future systems that are systemd 
based. So, you'd want to start with a spec file that was intended for the OS 
that you are using.

-Steve


--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit

Re: How can I install the latest version of Linux Audit on CentOS 6.8?

[Mateusz Piotrowski]

[-- Attachment #1.1: Type: text/plain, Size: 1151 bytes --]

Hello,

> On 15 Jul 2016, at 15:17, Steve Grubb <sgrubb@redhat.com> wrote:
> On Friday, July 15, 2016 2:52:02 PM EDT Mateusz Piotrowski wrote:
>> Is there an easier way to get the latest Linux Audit version on my system?
> Why wouldn't you start with the distribution tar file?
> http://people.redhat.com/sgrubb/audit/audit-2.6.5.tar.gz <http://people.redhat.com/sgrubb/audit/audit-2.6.5.tar.gz>

I was able to install the latest version from the tar file using the following commands. Thanks Steve!

curl -O http://people.redhat.com/sgrubb/audit/audit-2.6.5.tar.gz <http://people.redhat.com/sgrubb/audit/audit-2.6.5.tar.gz>
gzip -d audit-2.6.5.tar.gz
tar xf audit-2.6.5.tar
cd audit-2.6.5
yum install autoconf automake libtool tcp_wrappers-devel openldap-devel
# Python and libcap-ng didn't work for me.
# This is why I set --with-python and --with-libcap-ng to no instead to yes.
./configure --sbindir=/sbin --with-python=no --with-libwrap --enable-gssapi-krb5=yes --with-libcap-ng=no
make
make install

My CentOS is now running auditd version 2.6.5 (according to information within /var/log/audit/audit.log).


Cheers!

-m

[-- Attachment #1.2: Type: text/html, Size: 2040 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]

Re: How can I install the latest version of Linux Audit on CentOS 6.8? (Update on CentOS 7)

[Mateusz Piotrowski]

Hello,

On 18 Jul 2016, at 17:39, Mateusz Piotrowski <0mp@freebsd.org> wrote:
>> On 15 Jul 2016, at 15:17, Steve Grubb <sgrubb@redhat.com> wrote:
>> On Friday, July 15, 2016 2:52:02 PM EDT Mateusz Piotrowski wrote:
>>> Is there an easier way to get the latest Linux Audit version on my system?
>> Why wouldn't you start with the distribution tar file?
>> http://people.redhat.com/sgrubb/audit/audit-2.6.5.tar.gz
> 
> I was able to install the latest version from the tar file using the following commands. Thanks Steve!
> 
> curl -O http://people.redhat.com/sgrubb/audit/audit-2.6.5.tar.gz
> gzip -d audit-2.6.5.tar.gz
> tar xf audit-2.6.5.tar
> cd audit-2.6.5
> yum install autoconf automake libtool tcp_wrappers-devel openldap-devel
> # Python and libcap-ng didn't work for me.
> # This is why I set --with-python and --with-libcap-ng to no instead to yes.
> ./configure --sbindir=/sbin --with-python=no --with-libwrap --enable-gssapi-krb5=yes --with-libcap-ng=no
> make
> make install
> 
> My CentOS is now running auditd version 2.6.5 (according to information within /var/log/audit/audit.log).

I just wanted to send an update to this thread - I successfully installed a fully featured audit-userspace on CentOS 7 x86_64 
installed from a Minimal Install ISO.

Here's everything you need to build and install audit-userspace:

yum install libtool tcp_wrappers-devel openldap-devel python-devel libcap-ng-devel swig
./configure --sbindir=/sbin --with-python=yes --with-libwrap --enable-gssapi-krb5=yes --with-libcap-ng=yes
make
make install

Cheers!

-m