On 09/11/2018 06:51 AM, [email protected] wrote:
If by “all” activity, the customer means all activity, pam_tty_audit is
the only solution I have heard of that fits the bill:
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/security_guide/sec-configuring_pam_for_auditing
I'm not familiar with pam_tty_audit, and I didn't see / find ssh in the
linked page. Does pam_tty_audit capture content from SSH sessions?
What about ssh remote command execution?
I can conceptually see how it could if it hooks low enough into the tty
layer.
If by “all” activity, the customer means, “We want want a Serious
Business Stamp,” I recommend getting creative with your shell's
$HISTFILE, given that 98% of your activity occurs there.
I discourage this.
1) Depending on how it's done, it can break history across sessions.
2) The $HISTFILE is inherently user writable. Which means that the
user can modify it.
3) The $HISTFILE is a convenience.
4) The $HISTFILE is NOT an audit log.
5) Depending on how the shell is configured, commands can bypass the
$HISTFILE.
6) The $HISTFILE does nothing for people putting commands in a script
and then running the script. — I had someone do exactly this at my
last job.
I *HIGHLY* recommend running as much as you can through sudo. Sudo
events do end up in syslog on every system I've used.
--
Grant. . . .
unix || die
