Hi,
Now that I've got auditing to work on Fedora Core, I have a few more questions.
First, the boxes I've got it working on are connected to the internet and have
the latest updates. Now I need to make stuff work on boxes that are *not*
connected to the internet and are built off of the base CD/DVD.
I know I need the latest versions of the following packages on a system
audit
audit-lib
glibc-kernheaders
openssh
openssh-server
openssh-client
openssh-askpass
openssh-askpass-gnome
Do I need the latest of
audit-libs-devel
kernel
as well?
Also, what other packages are critical to get NISPOM compliance? Even when I
updated the above packages, it didn't look like failed logins on the gnome
desktop were generating events. I realize this may be particular to RHEL_64,
but I also figured I could just have an outdated package.
I'm asking this because when I set up my audit rules on RHEL4_64 with the base
auditing installed (none of the above updates). I wasn't getting any
login/logout events at all, based on my initial experience with the initial
Fedora configurations, I assume that I need to install updated packages.
I'm not using watches right now, only syscalls, which seem to catch everything I
need. It seems like Steve has put enough information in the event logs that it
is possible to build a GUI that parses, combines, and then displays the event
logs to the user. Each displayed event is on a single line and contains the
pertinent information about the event.
The only gotcha I had with FC5 was that I needed the updated openssh packages to
generate the events that indicated a logout event for ssh.
Bob Evans
JHU/APL
--
Linux-audit mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/linux-audit
