From mboxrd@z Thu Jan 1 00:00:00 1970 From: Dan Gruhn Subject: Re: Audit Prelude Logout Tracking Date: Thu, 19 Feb 2009 09:26:28 -0500 Message-ID: <499D6C14.5060205@groupw.com> References: <499C848C.6020401@groupw.com> <1234997046.11692.111.camel@homeserver> <1234999521.11692.118.camel@homeserver> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Return-path: Received: from mx3.redhat.com (mx3.redhat.com [172.16.48.32]) by int-mx1.corp.redhat.com (8.13.1/8.13.1) with ESMTP id n1JEQcAL022080 for ; Thu, 19 Feb 2009 09:26:38 -0500 Received: from smtp.group-w-inc.com (group-w-inc.com [70.164.45.3]) by mx3.redhat.com (8.13.8/8.13.8) with ESMTP id n1JEQTcj028836 for ; Thu, 19 Feb 2009 09:26:30 -0500 In-Reply-To: <1234999521.11692.118.camel@homeserver> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: LC Bruzenak Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com LC Bruzenak wrote: > On Wed, 2009-02-18 at 16:44 -0600, LC Bruzenak wrote: > >> On Wed, 2009-02-18 at 16:58 -0500, Dan Gruhn wrote: >> >>> I''m working on an X86_64 RHEL 5.2 system and for NISPOM Chapt. 8 I'm >>> looking to modify the audisp-prelude plugin so that I can get logout >>> events displayed. >>> >>> I see the information in the audit.log as USER_END and have done a small >>> mod in the handle_event routine in audisp-prelude.c so that it looks for >>> AUDIT_USER_END but I've run across the following things: >>> >>> 1) sshd goes through a login/logout cycle ending in USER_END and all is >>> good. >>> node=node01 type=USER_END msg=audit(1234979707.894:203): user pid=7422 >>> uid=0 auid=0 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 >>> msg='PAM: session close acct="root" : exe="/usr/sbin/sshd" >>> (hostname=master, addr=10.1.4.100, terminal=ssh res=success)' >>> >>> >>> > > Dan, > > The other question I had was, I suppose you see the AUDIT_USER_LOGIN > event type which triggers the prelude event (in audisp-prelude.c). I > would think that the matching AUDIT_USER_LOGOUT would be what you want > right? > > Can you find these events with ausearch like this?: > > # ausearch -ts today -i -m USER_LOGIN > ...and... > #ausearch -ts today -i -m USER_LOGOUT > > > LCB > > LCB, Thanks for the tip on the hostname/addr info is only for remote access information. Although this seemed like the right place to look, I don't see USER_LOGOUT events in my audit logs, this is why I mentioned the USER_END events. Do you remember USER_LOGOUT working back when you tried before? I am interested in the patches that you make to audisp-prelude.c. Do you think they might be useful to me in my NISPOM quest? If so, are they patches from 1.7.11 and could you send me a copy? Thanks, Dan