On Friday, June 17, 2011 11:10:41 AM Matteo Sessa wrote: > Attached is a patch for auditd to add support for TTY audits ( > pam_tty_audit session module ) to audisp-prelude. > > Alerts are reported with: > alert.classification.text = "Keylogger" > alert.assessment.impact.severity = LOW
Thanks for this contribution. I applied the patch with a couple minor revisions. > and actual keystrokes carried on alert.additional_data. Because of this ^^^ I am disabling it by default since I think you want to stop and consider if you really want keystrokes on your prelude database. > Attached you will find also a basic python commandline script to query > keylogger data from prelude database. If there was a little more explanation of this script in its text, I would add it to the contrib section to preserve it. Thanks, -Steve -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
