On Thursday 25 March 2010 11:17:14 am Robert Harris wrote: > My setup for auditd is the same in both places. However on the debian > system I get no audit events for user authentication for things like ssh > and su.
Maybe a Debian maintainer could answer how they do things...but in the mean time, the login events come from user space. On RHEL/Fedora, we have enabled auditing in the pam build. -Steve -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
