From: Steve Grubb <sgrubb@redhat.com>
To: Nathan Cooprider <ncooprider@yankeehacker.com>
Cc: linux-audit@redhat.com
Subject: Re: Auditd misses accept syscalls from sshd
Date: Fri, 02 Dec 2016 17:13:42 -0500 [thread overview]
Message-ID: <3309840.oCxPxWEFuR@x2> (raw)
In-Reply-To: <CAMMwpciFh5f+HHQEf9pfU5528koKK65zAFPVF5UHQBH3NswGLA@mail.gmail.com>
Hello,
Addressing a couple obvious things here...
On Friday, December 2, 2016 9:55:17 PM EST Nathan Cooprider wrote:
> On Fri, Dec 2, 2016 at 4:09 PM Steve Grubb <sgrubb@redhat.com> wrote:
> > On Friday, December 2, 2016 8:43:46 PM EST Nathan Cooprider wrote:
> > > Auditd seems to miss accept syscalls from ssh on Ubuntu 14.
> >
> > Its not auditd, the kernel does all the work. Auditd acts a lot like a
> > specialized syslog. :-)
> >
> > > I tried versions 2.3.2 and 2.4.5 of the daemon
Support was not added until 2.5.
> > > with kernel versions 3.13.0-96
Definitely won't support it.
> > > and 4.4.0-47.
The feature landed in 4.3, so 4.4 should have it. However, you need audit 2.5
or later to use the kernel feature.
> I just tried again and had the same problem:
>
> vagrant@vagrant:~$ uname -a
> Linux vagrant 4.4.0-51-generic #72~14.04.1-Ubuntu SMP Thu Nov 24 19:22:30
> UTC 2016 x86_64 x86_64 x86_64 GNU/Linux
Try pairing that with a newer auditd so that auditctl has the support to load
the rule.
-Steve
> That's a newer version than I have on my Ubuntu 16 VM, which does
> demonstrate the problem. It's also strange that restarting ssh then makes
> the accept syscall events show up. Other sshd syscalls show up in auditd
> before and after the ssh restart.
next prev parent reply other threads:[~2016-12-02 22:13 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-12-02 20:43 Auditd misses accept syscalls from sshd Nathan Cooprider
2016-12-02 21:09 ` Steve Grubb
2016-12-02 21:55 ` Nathan Cooprider
2016-12-02 22:13 ` Steve Grubb [this message]
2016-12-03 2:11 ` Nathan Cooprider
2016-12-03 17:47 ` Steve Grubb
2016-12-05 16:42 ` Nathan Cooprider
2016-12-05 22:44 ` Steve Grubb
2016-12-02 21:26 ` Paul Moore
2016-12-02 21:42 ` Nathan Cooprider
2016-12-02 21:56 ` Paul Moore
2016-12-02 23:44 ` Hassan Sultan
2016-12-03 2:15 ` Nathan Cooprider
2016-12-03 17:39 ` Steve Grubb
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=3309840.oCxPxWEFuR@x2 \
--to=sgrubb@redhat.com \
--cc=linux-audit@redhat.com \
--cc=ncooprider@yankeehacker.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).