On Monday, December 30, 2019 12:29:13 PM EST MAUPERTUIS, PHILIPPE wrote: > On a RHEL8 server, when playing around with usermod and chsh, I noticed > that usermod -c 'root@xxx' root generates a user_mgmt event > But > chsh -s /usr/bin/tlog-rec-session root didn't. > Is that the expected behavior ?
It depends. Did you get any event at all? There is a chance that you just have mismatching events. > I was expecting an event for both. There should be an event for both. > Should I open a ticket at redhat for this ? Let's see what the answer is for the above. But potentially yes. And if there is any change we'll be sure to get this into upstream shadow-utils so its uniform across all distros. -Steve -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
