* USER_MGMT event
@ 2019-12-30 17:29 MAUPERTUIS, PHILIPPE
2020-01-04 21:11 ` Steve Grubb
0 siblings, 1 reply; 4+ messages in thread
From: MAUPERTUIS, PHILIPPE @ 2019-12-30 17:29 UTC (permalink / raw)
To: linux-audit@redhat.com
[-- Attachment #1.1: Type: text/plain, Size: 1245 bytes --]
Hi,
On a RHEL8 server, when playing around with usermod and chsh, I noticed that
usermod -c 'root@xxx' root generates a user_mgmt event
But
chsh -s /usr/bin/tlog-rec-session root didn't.
Is that the expected behavior ?
I was expecting an event for both.
Should I open a ticket at redhat for this ?
Regards
Philippe
equensWorldline is a registered trade mark and trading name owned by the Worldline Group through its holding company.
This e-mail and the documents attached are confidential and intended solely for the addressee. If you receive this e-mail in error, you are not authorized to copy, disclose, use or retain it. Please notify the sender immediately and delete this email from your systems. As emails may be intercepted, amended or lost, they are not secure. EquensWorldline and the Worldline Group therefore can accept no liability for any errors or their content. Although equensWorldline and the Worldline Group endeavours to maintain a virus-free network, we do not warrant that this transmission is virus-free and can accept no liability for any damages resulting from any virus transmitted. The risks are deemed to be accepted by everyone who communicates with equensWorldline and the Worldline Group by email
[-- Attachment #1.2: Type: text/html, Size: 6492 bytes --]
[-- Attachment #2: Type: text/plain, Size: 0 bytes --]
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: USER_MGMT event
2019-12-30 17:29 USER_MGMT event MAUPERTUIS, PHILIPPE
@ 2020-01-04 21:11 ` Steve Grubb
2020-01-06 9:44 ` MAUPERTUIS, PHILIPPE
0 siblings, 1 reply; 4+ messages in thread
From: Steve Grubb @ 2020-01-04 21:11 UTC (permalink / raw)
To: linux-audit; +Cc: MAUPERTUIS, PHILIPPE
On Monday, December 30, 2019 12:29:13 PM EST MAUPERTUIS, PHILIPPE wrote:
> On a RHEL8 server, when playing around with usermod and chsh, I noticed
> that usermod -c 'root@xxx' root generates a user_mgmt event
> But
> chsh -s /usr/bin/tlog-rec-session root didn't.
> Is that the expected behavior ?
It depends. Did you get any event at all? There is a chance that you just
have mismatching events.
> I was expecting an event for both.
There should be an event for both.
> Should I open a ticket at redhat for this ?
Let's see what the answer is for the above. But potentially yes. And if there
is any change we'll be sure to get this into upstream shadow-utils so its
uniform across all distros.
-Steve
^ permalink raw reply [flat|nested] 4+ messages in thread
* RE: USER_MGMT event
2020-01-04 21:11 ` Steve Grubb
@ 2020-01-06 9:44 ` MAUPERTUIS, PHILIPPE
2020-01-06 13:52 ` Steve Grubb
0 siblings, 1 reply; 4+ messages in thread
From: MAUPERTUIS, PHILIPPE @ 2020-01-06 9:44 UTC (permalink / raw)
To: Steve Grubb; +Cc: linux-audit@redhat.com
Hi,
Below is the complete log of the session where I did :
1) remove all rules
2) change root's shell using chsh
3) ausearch
4) change root's shell using usermod
4 ausearch
There is no event at all for the chsh
Philippe
[root@xxxxxxxxx ~]# auditctl -D
No rules
[root@xxxxxxxxx ~]# getent passwd root
root:x:0:0:root@xxxxxxxxx:/root:/bin/bash
[root@xxxxxxxxx ~]# chsh -l
/bin/sh
/bin/bash
/usr/bin/sh
/usr/bin/bash
/usr/bin/tlog-rec-session
[root@xxxxxxxxx ~]# chsh -s /usr/bin/tlog-rec-session root
Changing shell for root.
Shell changed.
[root@xxxxxxxxx ~]# ausearch -ts recent -i
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.516:9514) : auid=u12345 ses=104 op=remove_rule key=(null) list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.516:9515) : auid=u12345 ses=104 op=remove_rule key=(null) list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.516:9516) : auid=u12345 ses=104 op=remove_rule key=(null) list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.521:9517) : auid=u12345 ses=104 op=remove_rule key=(null) list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.521:9518) : auid=u12345 ses=104 op=remove_rule key=(null) list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.521:9519) : auid=u12345 ses=104 op=remove_rule key=32bit-abi list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.521:9520) : auid=u12345 ses=104 op=remove_rule key=ignore_chrony list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.521:9521) : auid=u12345 ses=104 op=remove_rule key=10.2.1-cardholder-access list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.521:9522) : auid=u12345 ses=104 op=remove_rule key=10.2.3-access-audit-trail list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.521:9523) : auid=u12345 ses=104 op=remove_rule key=10.2.3-access-audit-trail list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.521:9524) : auid=u12345 ses=104 op=remove_rule key=10.2.3-access-audit-trail list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.521:9525) : auid=u12345 ses=104 op=remove_rule key=10.2.3-access-audit-trail list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.521:9526) : auid=u12345 ses=104 op=remove_rule key=10.2.3-access-audit-trail list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.521:9527) : auid=u12345 ses=104 op=remove_rule key=10.2.3-access-audit-trail list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9528) : auid=u12345 ses=104 op=remove_rule key=10.2.5.b-elevated-privs-session list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9529) : auid=u12345 ses=104 op=remove_rule key=10.2.5.b-elevated-privs-session list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9530) : auid=u12345 ses=104 op=remove_rule key=10.2.5.b-elevated-privs-setuid list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9531) : auid=u12345 ses=104 op=remove_rule key=10.2.5.b-elevated-privs-cmd list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9532) : auid=u12345 ses=104 op=remove_rule key=10.2.5.c-accounts list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9533) : auid=u12345 ses=104 op=remove_rule key=10.2.5.c-accounts list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9534) : auid=u12345 ses=104 op=remove_rule key=10.2.5.c-accounts list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9535) : auid=u12345 ses=104 op=remove_rule key=10.2.5.c-accounts list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9536) : auid=u12345 ses=104 op=remove_rule key=10.2.5.c-accounts list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9537) : auid=u12345 ses=104 op=remove_rule key=10.4.2b-time-change list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9538) : auid=u12345 ses=104 op=remove_rule key=10.4.2b-time-change list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9539) : auid=u12345 ses=104 op=remove_rule key=10.4.2b-time-change list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9540) : auid=u12345 ses=104 op=remove_rule key=10.5.5-modification-audit list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9541) : auid=u12345 ses=104 op=remove_rule key=10.2.7-module-load list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9542) : auid=u12345 ses=104 op=remove_rule key=10.2.7-module-load list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9543) : auid=u12345 ses=104 op=remove_rule key=10.2.7-module-unload list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9544) : auid=u12345 ses=104 op=remove_rule key=10.2.7-module-unload list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9545) : auid=u12345 ses=104 op=remove_rule key=external-access list=exit res=yes
[root@xxxxxxxxx ~]# usermod -s /bin/bash root
[root@xxxxxxxxx ~]# ausearch -ts recent -i
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.516:9514) : auid=u12345 ses=104 op=remove_rule key=(null) list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.516:9515) : auid=u12345 ses=104 op=remove_rule key=(null) list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.516:9516) : auid=u12345 ses=104 op=remove_rule key=(null) list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.521:9517) : auid=u12345 ses=104 op=remove_rule key=(null) list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.521:9518) : auid=u12345 ses=104 op=remove_rule key=(null) list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.521:9519) : auid=u12345 ses=104 op=remove_rule key=32bit-abi list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.521:9520) : auid=u12345 ses=104 op=remove_rule key=ignore_chrony list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.521:9521) : auid=u12345 ses=104 op=remove_rule key=10.2.1-cardholder-access list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.521:9522) : auid=u12345 ses=104 op=remove_rule key=10.2.3-access-audit-trail list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.521:9523) : auid=u12345 ses=104 op=remove_rule key=10.2.3-access-audit-trail list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.521:9524) : auid=u12345 ses=104 op=remove_rule key=10.2.3-access-audit-trail list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.521:9525) : auid=u12345 ses=104 op=remove_rule key=10.2.3-access-audit-trail list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.521:9526) : auid=u12345 ses=104 op=remove_rule key=10.2.3-access-audit-trail list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.521:9527) : auid=u12345 ses=104 op=remove_rule key=10.2.3-access-audit-trail list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9528) : auid=u12345 ses=104 op=remove_rule key=10.2.5.b-elevated-privs-session list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9529) : auid=u12345 ses=104 op=remove_rule key=10.2.5.b-elevated-privs-session list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9530) : auid=u12345 ses=104 op=remove_rule key=10.2.5.b-elevated-privs-setuid list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9531) : auid=u12345 ses=104 op=remove_rule key=10.2.5.b-elevated-privs-cmd list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9532) : auid=u12345 ses=104 op=remove_rule key=10.2.5.c-accounts list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9533) : auid=u12345 ses=104 op=remove_rule key=10.2.5.c-accounts list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9534) : auid=u12345 ses=104 op=remove_rule key=10.2.5.c-accounts list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9535) : auid=u12345 ses=104 op=remove_rule key=10.2.5.c-accounts list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9536) : auid=u12345 ses=104 op=remove_rule key=10.2.5.c-accounts list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9537) : auid=u12345 ses=104 op=remove_rule key=10.4.2b-time-change list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9538) : auid=u12345 ses=104 op=remove_rule key=10.4.2b-time-change list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9539) : auid=u12345 ses=104 op=remove_rule key=10.4.2b-time-change list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9540) : auid=u12345 ses=104 op=remove_rule key=10.5.5-modification-audit list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9541) : auid=u12345 ses=104 op=remove_rule key=10.2.7-module-load list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9542) : auid=u12345 ses=104 op=remove_rule key=10.2.7-module-load list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9543) : auid=u12345 ses=104 op=remove_rule key=10.2.7-module-unload list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9544) : auid=u12345 ses=104 op=remove_rule key=10.2.7-module-unload list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9545) : auid=u12345 ses=104 op=remove_rule key=external-access list=exit res=yes
----
node=xxxxxxxxx type=USER_MGMT msg=audit(01/06/2020 10:04:22.552:9546) : pid=6937 uid=root auid=u12345 ses=104 msg='op=changing-shell id=root exe=/usr/sbin/usermod hostname=xxxxxxxxx addr=? terminal=pts/0 res=success'
-----Message d'origine-----
De : Steve Grubb [mailto:sgrubb@redhat.com]
Envoyé : samedi 4 janvier 2020 22:12
À : linux-audit@redhat.com
Cc : MAUPERTUIS, PHILIPPE
Objet : Re: USER_MGMT event
On Monday, December 30, 2019 12:29:13 PM EST MAUPERTUIS, PHILIPPE wrote:
> On a RHEL8 server, when playing around with usermod and chsh, I noticed
> that usermod -c 'root@xxx' root generates a user_mgmt event
> But
> chsh -s /usr/bin/tlog-rec-session root didn't.
> Is that the expected behavior ?
It depends. Did you get any event at all? There is a chance that you just
have mismatching events.
> I was expecting an event for both.
There should be an event for both.
> Should I open a ticket at redhat for this ?
Let's see what the answer is for the above. But potentially yes. And if there
is any change we'll be sure to get this into upstream shadow-utils so its
uniform across all distros.
-Steve
equensWorldline is a registered trade mark and trading name owned by the Worldline Group through its holding company.
This e-mail and the documents attached are confidential and intended solely for the addressee. If you receive this e-mail in error, you are not authorized to copy, disclose, use or retain it. Please notify the sender immediately and delete this email from your systems. As emails may be intercepted, amended or lost, they are not secure. EquensWorldline and the Worldline Group therefore can accept no liability for any errors or their content. Although equensWorldline and the Worldline Group endeavours to maintain a virus-free network, we do not warrant that this transmission is virus-free and can accept no liability for any damages resulting from any virus transmitted. The risks are deemed to be accepted by everyone who communicates with equensWorldline and the Worldline Group by email
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: USER_MGMT event
2020-01-06 9:44 ` MAUPERTUIS, PHILIPPE
@ 2020-01-06 13:52 ` Steve Grubb
0 siblings, 0 replies; 4+ messages in thread
From: Steve Grubb @ 2020-01-06 13:52 UTC (permalink / raw)
To: MAUPERTUIS, PHILIPPE; +Cc: linux-audit@redhat.com
On Monday, January 6, 2020 4:44:07 AM EST MAUPERTUIS, PHILIPPE wrote:
> On Monday, December 30, 2019 12:29:13 PM EST MAUPERTUIS, PHILIPPE wrote:
> > On a RHEL8 server, when playing around with usermod and chsh, I noticed
> > that usermod -c 'root@xxx' root generates a user_mgmt event
> > But chsh -s /usr/bin/tlog-rec-session root didn't.
> > Is that the expected behavior ?
>
> It depends. Did you get any event at all? There is a chance that you just
> have mismatching events.
>
> > I was expecting an event for both.
>
> There should be an event for both.
>
> > Should I open a ticket at redhat for this ?
>
> Let's see what the answer is for the above.
Based on the logs provided, I'd say that opening a ticket is the right thing
to do.
-Steve
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2020-01-06 13:52 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2019-12-30 17:29 USER_MGMT event MAUPERTUIS, PHILIPPE
2020-01-04 21:11 ` Steve Grubb
2020-01-06 9:44 ` MAUPERTUIS, PHILIPPE
2020-01-06 13:52 ` Steve Grubb
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox