On Friday 25 May 2007 13:21, Michael Folsom wrote: > Did a little test on a X86-64 SLES10 SP1 RC2 system - sshed into in > and did see the USER_LOGIN line then got out via either an exit or > logout and never see an USER_END statement.
If I remember correctly, there was a bug in a patch to sshd that called pam_session_close from the unprivileged process. I think we moved this and sent the patch upstream. > Could this be an issue in Suse's implementation of audit? There might be a sshd patch that needs backporting from openssh cvs. -Steve -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
