From mboxrd@z Thu Jan 1 00:00:00 1970 From: Linda Knippers Subject: Re: Current capabilities Date: Wed, 13 Dec 2006 18:39:40 -0500 Message-ID: <45808F3C.3020503@hp.com> References: <1166051787.6399.23.camel@cisco.sandia.gov> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Return-path: Received: from mx1.redhat.com (mx1.redhat.com [172.16.48.31]) by int-mx1.corp.redhat.com (8.13.1/8.13.1) with ESMTP id kBDNfITk022739 for ; Wed, 13 Dec 2006 18:41:18 -0500 Received: from atlrel8.hp.com (atlrel8.hp.com [156.153.255.206]) by mx1.redhat.com (8.12.11.20060308/8.12.11) with ESMTP id kBDNfH4b025159 for ; Wed, 13 Dec 2006 18:41:17 -0500 In-Reply-To: <1166051787.6399.23.camel@cisco.sandia.gov> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Michael W Folsom Cc: Linux Audit List List-Id: linux-audit@redhat.com Michael W Folsom wrote: > I've been lurking on this list for a while now and am a bit confused at > the current state of audit's capabilities. I've looked at: > http://people.redhat.com/sgrubb/audit/ > and still aren't sure if it is capable of doing what I need. To get to > the point the events I need to record in an audit log are - If you're interested in RHEL4 then I suggest you look at the updates. HP and IBM have both completed CAPP evaluations of RHEL4 and when properly configured the system and audit framework supports what you want. For details, check out HP's documentation at: http://h71028.www7.hp.com/enterprise/downloads/RHEL-CAPP-EAL3-HP-Configuration-Guide.pdf or IBM's at: ftp://www6.software.ibm.com/software/developer/library/os-ltc-security/RHEL-CAPP-EAL4-IBM-Configuration-Guide-v1.14.pdf > 1) If someone tries to access an object (file, directory, program) that > they don't have rights to the event needs to be recorded You can configure the audit system to audit specific system calls that fail. > > 2) if someone logs into a system and su's to another user or series of > users their actions need to be traceable to the original login user's > id The audit system keeps track of the login uid as well as the current uid, so I believe it does what you want. > > Can this be done with the current audit system in RHEL4 or will this not > be supported until RHEL5 is released? Are there any other Linux > distro's that can do this? SLES8 as of SP3 can do the same thing, only with a different audit framework. > If either of these are true where would I > look for information how to get this to work. -- ljk > > > Thanks! > > -- > Linux-audit mailing list > Linux-audit@redhat.com > https://www.redhat.com/mailman/listinfo/linux-audit