From mboxrd@z Thu Jan 1 00:00:00 1970 From: Robert Evans Subject: Offline configuration Date: Fri, 25 May 2007 12:23:40 -0400 Message-ID: <46570D8C.8090504@jhuapl.edu> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Return-path: Received: from mx1.redhat.com (mx1.redhat.com [172.16.48.31]) by int-mx1.corp.redhat.com (8.13.1/8.13.1) with ESMTP id l4PGO0n3022444 for ; Fri, 25 May 2007 12:24:00 -0400 Received: from jhuapl.edu (pilot.jhuapl.edu [128.244.198.200]) by mx1.redhat.com (8.13.1/8.13.1) with ESMTP id l4PGNsEQ027113 for ; Fri, 25 May 2007 12:23:56 -0400 List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com Hi, Now that I've got auditing to work on Fedora Core, I have a few more questions. First, the boxes I've got it working on are connected to the internet and have the latest updates. Now I need to make stuff work on boxes that are *not* connected to the internet and are built off of the base CD/DVD. I know I need the latest versions of the following packages on a system audit audit-lib glibc-kernheaders openssh openssh-server openssh-client openssh-askpass openssh-askpass-gnome Do I need the latest of audit-libs-devel kernel as well? Also, what other packages are critical to get NISPOM compliance? Even when I updated the above packages, it didn't look like failed logins on the gnome desktop were generating events. I realize this may be particular to RHEL_64, but I also figured I could just have an outdated package. I'm asking this because when I set up my audit rules on RHEL4_64 with the base auditing installed (none of the above updates). I wasn't getting any login/logout events at all, based on my initial experience with the initial Fedora configurations, I assume that I need to install updated packages. I'm not using watches right now, only syscalls, which seem to catch everything I need. It seems like Steve has put enough information in the event logs that it is possible to build a GUI that parses, combines, and then displays the event logs to the user. Each displayed event is on a single line and contains the pertinent information about the event. The only gotcha I had with FC5 was that I needed the updated openssh packages to generate the events that indicated a logout event for ssh. Bob Evans JHU/APL