Number of TTY events vs Number of USER_TTY events

Number of TTY events vs Number of USER_TTY events

[Smith, Gary R]

[-- Attachment #1.1: Type: text/plain, Size: 828 bytes --]

Good afternoon,

I have TTY auditing set up on a number of hosts using pam_tty_audit for the root account. I have this line in a PAM file to enable it:

session   required pam_tty_audit.so disable=* enable=root

In looking at the reports from aureport and ausearch, the number of TTY events is always equal to the number of USER_TTY events. For instance:

# ausearch -i -m TTY -ts today | wc -l ; ausearch -i -m USER_TTY -ts today | wc -l
20
20

I started wondering, “Are there always the same number of these two event types?” I tried constructing some synthetic cases to see if there is a case where there isn’t an equal number of the two events. I couldn’t construct such a case.  Is there a case of cases where the two type event types aren’t of equal number?

Thanks for your help,

Gary Smith


[-- Attachment #1.2: Type: text/html, Size: 3578 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]

Re: Number of TTY events vs Number of USER_TTY events

[Steve Grubb]

On Wednesday, August 7, 2019 6:13:19 PM EDT Smith, Gary R wrote:
> I have TTY auditing set up on a number of hosts using pam_tty_audit for the
> root account. I have this line in a PAM file to enable it:
 
> session   required pam_tty_audit.so disable=* enable=root
> 
> In looking at the reports from aureport and ausearch, the number of TTY
> events is always equal to the number of USER_TTY events. For instance:
 
> # ausearch -i -m TTY -ts today | wc -l ; ausearch -i -m USER_TTY -ts today
> | wc -l
> 20
> 20
> 
> I started wondering, “Are there always the same number of these two event
> types?” I tried constructing some synthetic cases to see if there is a
> case where there isn’t an equal number of the two events. I couldn’t
> construct such a case.  Is there a case of cases where the two type event
> types aren’t of equal number?

I think that is just a coincidence. I don't think there is any attempt to 
keep them in sync. For example, if you open a document and edit it for a long 
time, you will probably get them out of sync because the bash based one loses 
visibility of what's happening in the document editor. Meanwhile the kernel 
still sees everything.

-Steve



--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit