Auditing printing

Auditing printing

[warron.french]

[-- Attachment #1.1: Type: text/plain, Size: 530 bytes --]

I have a requirement to monitor two (2) things:

1. Print to file

2. Print to (printer) device


What is the best approach for this?  I don't see a syscall that looks
appropriate - but that doesn't mean there is not one.

Would I simply do an audit on the *lpr* command?  Or is it another command?

I need the ability to monitor printing to both file and device, *FROM*,
linux shell as well as console or GUI.

Can someone advise me on how to accomplish this please?


Thanks in advance,
--------------------------
Warron French

[-- Attachment #1.2: Type: text/html, Size: 1113 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]

Re: Auditing printing

[Steve Grubb]

On Tuesday, May 1, 2018 2:05:36 PM EDT warron.french wrote:
> I have a requirement to monitor two (2) things:
> 
> 1. Print to file
> 
> 2. Print to (printer) device
> 
> 
> What is the best approach for this?

Cups should be hardwired to audit.

# ldd /usr/sbin/cupsd | grep audit
	libaudit.so.1 => /lib64/libaudit.so.1 (0x00007f04f1cfa000)

It's been a long time since I looked at this.

-Steve

> I don't see a syscall that looks
> appropriate - but that doesn't mean there is not one.
> 
> Would I simply do an audit on the *lpr* command?  Or is it another command?
> 
> I need the ability to monitor printing to both file and device, *FROM*,
> linux shell as well as console or GUI.
> 
> Can someone advise me on how to accomplish this please?
> 
> 
> Thanks in advance,
> --------------------------
> Warron French

Re: Auditing printing

[warron.french]

[-- Attachment #1.1: Type: text/plain, Size: 1145 bytes --]

OK, so that will cover from CLI as well as something in the gui like
Firefox?

For both printing to a print device as well as to a file?

--------------------------
Warron French


On Tue, May 1, 2018 at 2:20 PM, Steve Grubb <sgrubb@redhat.com> wrote:

> On Tuesday, May 1, 2018 2:05:36 PM EDT warron.french wrote:
> > I have a requirement to monitor two (2) things:
> >
> > 1. Print to file
> >
> > 2. Print to (printer) device
> >
> >
> > What is the best approach for this?
>
> Cups should be hardwired to audit.
>
> # ldd /usr/sbin/cupsd | grep audit
>         libaudit.so.1 => /lib64/libaudit.so.1 (0x00007f04f1cfa000)
>
> It's been a long time since I looked at this.
>
> -Steve
>
> > I don't see a syscall that looks
> > appropriate - but that doesn't mean there is not one.
> >
> > Would I simply do an audit on the *lpr* command?  Or is it another
> command?
> >
> > I need the ability to monitor printing to both file and device, *FROM*,
> > linux shell as well as console or GUI.
> >
> > Can someone advise me on how to accomplish this please?
> >
> >
> > Thanks in advance,
> > --------------------------
> > Warron French
>
>
>
>
>

[-- Attachment #1.2: Type: text/html, Size: 1994 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]

Re: Auditing printing

[Steve Grubb]

On Tuesday, May 1, 2018 2:29:56 PM EDT warron.french wrote:
> OK, so that will cover from CLI as well as something in the gui like
> Firefox?
> 
> For both printing to a print device as well as to a file?

I haven't looked at this code in a very long time. So, I don't remember how 
to enable it to test it. But it should have full coverage to meet export 
requirements for LSPP way back on RHEL 5. The code has been ported all these 
years and is supposed to still work.

-Steve

> On Tue, May 1, 2018 at 2:20 PM, Steve Grubb <sgrubb@redhat.com> wrote:
> > On Tuesday, May 1, 2018 2:05:36 PM EDT warron.french wrote:
> > > I have a requirement to monitor two (2) things:
> > > 
> > > 1. Print to file
> > > 
> > > 2. Print to (printer) device
> > > 
> > > 
> > > What is the best approach for this?
> > 
> > Cups should be hardwired to audit.
> > 
> > # ldd /usr/sbin/cupsd | grep audit
> > 
> >         libaudit.so.1 => /lib64/libaudit.so.1 (0x00007f04f1cfa000)
> > 
> > It's been a long time since I looked at this.
> > 
> > -Steve
> > 
> > > I don't see a syscall that looks
> > > appropriate - but that doesn't mean there is not one.
> > > 
> > > Would I simply do an audit on the *lpr* command?  Or is it another
> > 
> > command?
> > 
> > > I need the ability to monitor printing to both file and device, *FROM*,
> > > linux shell as well as console or GUI.
> > > 
> > > Can someone advise me on how to accomplish this please?
> > > 
> > > 
> > > Thanks in advance,
> > > --------------------------
> > > Warron French

Re: Auditing printing

[warron.french]

[-- Attachment #1.1: Type: text/plain, Size: 1766 bytes --]

Thanks for the feedback Steve.

--------------------------
Warron French


On Tue, May 1, 2018 at 5:53 PM, Steve Grubb <sgrubb@redhat.com> wrote:

> On Tuesday, May 1, 2018 2:29:56 PM EDT warron.french wrote:
> > OK, so that will cover from CLI as well as something in the gui like
> > Firefox?
> >
> > For both printing to a print device as well as to a file?
>
> I haven't looked at this code in a very long time. So, I don't remember
> how
> to enable it to test it. But it should have full coverage to meet export
> requirements for LSPP way back on RHEL 5. The code has been ported all
> these
> years and is supposed to still work.
>
> -Steve
>
> > On Tue, May 1, 2018 at 2:20 PM, Steve Grubb <sgrubb@redhat.com> wrote:
> > > On Tuesday, May 1, 2018 2:05:36 PM EDT warron.french wrote:
> > > > I have a requirement to monitor two (2) things:
> > > >
> > > > 1. Print to file
> > > >
> > > > 2. Print to (printer) device
> > > >
> > > >
> > > > What is the best approach for this?
> > >
> > > Cups should be hardwired to audit.
> > >
> > > # ldd /usr/sbin/cupsd | grep audit
> > >
> > >         libaudit.so.1 => /lib64/libaudit.so.1 (0x00007f04f1cfa000)
> > >
> > > It's been a long time since I looked at this.
> > >
> > > -Steve
> > >
> > > > I don't see a syscall that looks
> > > > appropriate - but that doesn't mean there is not one.
> > > >
> > > > Would I simply do an audit on the *lpr* command?  Or is it another
> > >
> > > command?
> > >
> > > > I need the ability to monitor printing to both file and device,
> *FROM*,
> > > > linux shell as well as console or GUI.
> > > >
> > > > Can someone advise me on how to accomplish this please?
> > > >
> > > >
> > > > Thanks in advance,
> > > > --------------------------
> > > > Warron French
>
>
>
>
>

[-- Attachment #1.2: Type: text/html, Size: 2964 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]