Offline configuration

[Robert Evans <bob.evans@jhuapl.edu>]

Hi,

Now that I've got auditing to work on Fedora Core, I have a few more questions.

First, the boxes I've got it working on are connected to the internet and have 
the latest updates.  Now I need to make stuff work on boxes that are *not* 
connected to the internet and are built off of the base CD/DVD.

I know I need the latest versions of the following packages on a system
   audit
   audit-lib
   glibc-kernheaders
   openssh
   openssh-server
   openssh-client
   openssh-askpass
   openssh-askpass-gnome

Do I need the latest of
   audit-libs-devel
   kernel
as well?

Also, what other packages are critical to get NISPOM compliance?  Even when I 
updated the above packages, it didn't look like failed logins on the gnome 
desktop were generating events.  I realize this may be particular to RHEL_64, 
but I also figured I could just have an outdated package.

I'm asking this because when I set up my audit rules on RHEL4_64 with the base 
auditing installed (none of the above updates).  I wasn't getting any 
login/logout events at all, based on my initial experience with the initial 
Fedora configurations, I assume that I need to install updated packages.

I'm not using watches right now, only syscalls, which seem to catch everything I 
need.  It seems like Steve has put enough information in the event logs that it 
is possible to build a GUI that parses, combines, and then displays the event 
logs to the user.  Each displayed event is on a single line and contains the 
pertinent information about the event.

The only gotcha I had with FC5 was that I needed the updated openssh packages to 
generate the events that indicated a logout event for ssh.

Bob Evans
JHU/APL