From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: Strange behavior with pam_tty_audit Date: Tue, 14 Nov 2017 08:53:02 -0500 Message-ID: <2393137.nNdHcdsWyM@x2> References: <3D2AB1326AB2974190FCE3F69401F7900102F4CE0DDD@FRVDX103.fr01.awl.atosorigin.net> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <3D2AB1326AB2974190FCE3F69401F7900102F4CE0DDD@FRVDX103.fr01.awl.atosorigin.net> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com Cc: Maupertuis Philippe List-Id: linux-audit@redhat.com Hello, On Tuesday, November 14, 2017 8:29:34 AM EST Maupertuis Philippe wrote: > The auditd rules for PCI reads : > ## 10.2.2 Log administrative action. To meet this, you need to enable tty > ## logging. The pam config below should be placed into su and sudo pam > stacks. ## session required pam_tty_audit.so disable=* enable=root > > I have noticed that nothing happened unless I add in /etc/pam.d/sshd > session required pam_tty_audit.so enable=* If I understand, you deleted the 'disable=*' and replaced 'root' with '*'. That would be unusual. The command line is processed from left to right. So, what should happen in the original rule is disable auditing of all users, then enable auditing of only root. PCI wants administrative actions which would only be the root user. > At which point I get > > Should it be done that way ? > Did I miss something ? It works for me as specified in the PCI rules. (Tested using su.) Note that the kernel caches the keystrokes and you do not get a 1x1 mapping of events to commands entered. You will likely get multiple commands all strung together. It only creates the event when either it fills the buffer or the user ends the privileged session. -Steve