From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Alarie, Maxime" Subject: ausearch with message types does not return what I think it would return. (0 matches when adding a user) Date: Tue, 30 Jun 2015 15:12:40 +0000 Message-ID: <23396023F719ED41888885C3B22D602F0123D1@WPEXCH2010MR21.bur.hydro.qc.ca> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============0232109947216699294==" Return-path: Received: from mx1.redhat.com (ext-mx03.extmail.prod.ext.phx2.redhat.com [10.5.110.27]) by int-mx09.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id t5UFCm2Y010347 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO) for ; Tue, 30 Jun 2015 11:12:48 -0400 Received: from boris.zerospam.ca (boris.zerospam.ca [216.46.11.244]) by mx1.redhat.com (Postfix) with ESMTPS id 63936A0B9F for ; Tue, 30 Jun 2015 15:12:45 +0000 (UTC) Received: from boris.zerospam.ca (localhost [127.0.0.1]) by boris.zerospam.ca (Postfix) with ESMTP id 3mLThC5vG6z2xD2 for ; Tue, 30 Jun 2015 11:12:43 -0400 (EDT) Received: from smtp20.hydro.qc.ca (smtp20.hydro.qc.ca [199.22.60.220]) (using TLSv1 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by boris.zerospam.ca (Postfix) with ESMTPS id 3mLThB5v4wz2yfG for ; Tue, 30 Jun 2015 11:12:42 -0400 (EDT) Received: from localhost (localhost [127.0.0.1]) by smtp20.hydro.qc.ca (Postfix) with ESMTP id A6BD24003 for ; Tue, 30 Jun 2015 11:12:42 -0400 (EDT) Received: from smtp20.hydro.qc.ca ([10.16.56.108]) by localhost (localhost [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SSz_jBa5MbUs for ; Tue, 30 Jun 2015 11:12:42 -0400 (EDT) Received: from smtp21-sortant.hydro.qc.ca (smtp21-sortant.dmz.hydro.qc.ca [10.16.56.78]) by smtp20.hydro.qc.ca (Postfix) with ESMTPS id 946764002 for ; Tue, 30 Jun 2015 11:12:42 -0400 (EDT) Received: from WPEXCH2010MR21.bur.hydro.qc.ca (wpexch2010mr21.bur.hydro.qc.ca [10.16.30.152]) by smtp21-sortant.hydro.qc.ca (Postfix) with ESMTPS id 8D6366011 for ; Tue, 30 Jun 2015 11:12:42 -0400 (EDT) Content-Language: fr-FR List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: "linux-audit@redhat.com" List-Id: linux-audit@redhat.com --===============0232109947216699294== Content-Language: fr-FR Content-Type: multipart/alternative; boundary="_000_23396023F719ED41888885C3B22D602F0123D1WPEXCH2010MR21bur_" --_000_23396023F719ED41888885C3B22D602F0123D1WPEXCH2010MR21bur_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Good day, I am new with auditd, and got some issues.. For example, When I add or delete a user, I cannot see the entry with aus= earch -m ADD_USER, it returns 0 match, BUT its logging it under USER_AUTH.= If I do a ausearch -x adduser, ill thee se event audit.log with the EXECVE= Type: # ausearch -x useradd | grep titi type=3DEXECVE msg=3Daudit(1435677075.900:49410): argc=3D2 a0=3D"useradd" a1= =3D"titi" I also tried to find a full description of all message types returned by = ausearch -m but could not find any.. Any help on this would be appreciate= d as well. Many thanks. --_000_23396023F719ED41888885C3B22D602F0123D1WPEXCH2010MR21bur_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Good day,

I am new with auditd, and got s= ome issues..

For example, When I add o= r delete a user, I cannot see the entry with ausearch –m ADD_US= ER, it returns 0 match, BUT its logging it under USER_AUTH. If I do a= ausearch –x adduser, ill thee se event audit.log with the EXECVE Type:

# ausearch -x useradd | grep ti= ti

type=3DEXECVE msg=3Daudit(14356= 77075.900:49410): argc=3D2 a0=3D"useradd" a1=3D"titi"

I also tried to find a fu= ll description of all message types returned by ausearch –m &nb= sp;but could not find any.. Any help on this would be appreciated as = well.

Many thanks.<= /p>

--_000_23396023F719ED41888885C3B22D602F0123D1WPEXCH2010MR21bur_-- --===============0232109947216699294== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============0232109947216699294==-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: ausearch with message types does not return what I think it would return. (0 matches when adding a user) Date: Tue, 30 Jun 2015 11:22:17 -0400 Message-ID: <4397065.b5uXy4mKpJ@x2> References: <23396023F719ED41888885C3B22D602F0123D1@WPEXCH2010MR21.bur.hydro.qc.ca> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <23396023F719ED41888885C3B22D602F0123D1@WPEXCH2010MR21.bur.hydro.qc.ca> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Tuesday, June 30, 2015 03:12:40 PM Alarie, Maxime wrote: > I am new with auditd, and got some issues.. > > For example, When I add or delete a user, I cannot see the entry with > ausearch -m ADD_USER, it returns 0 match, BUT its logging it under > USER_AUTH. If I do a ausearch -x adduser, ill thee se event audit.log with > the EXECVE Type: > > # ausearch -x useradd | grep titi > type=EXECVE msg=audit(1435677075.900:49410): argc=2 a0="useradd" a1="titi" > > I also tried to find a full description of all message types returned by > ausearch -m but could not find any.. Any help on this would be > appreciated as well. I think we discovered that shadow-utils had messed up the auditing pretty badly a few months ago. It caused me to write a document[1] that outlines how its supposed to work so that we can check any and all implementations to make sure they follow the standard. The shadow-utils in RHEL7.1 was patched to be correct and I presume the patch should be upstream by now. So, I believe that is what you are seeing. Shadow-utils is a horrible piece of code for auditing because there are about 320 places that have audit events generated. I think upstream made it a little better, but its a huge problem because all those events have to be correct...and they weren't. -Steve [1] - http://people.redhat.com/sgrubb/audit/user-account-lifecycle.txt