[Bug 1948357] Re: sshd have no USER_LOGOUT audit event

2021-10-21 Thread lizhijian
first report here: https://listman.redhat.com/archives/linux-
audit/2021-October/msg00069.html

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1948357

Title:
  sshd have no USER_LOGOUT audit event

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/1948357/+subscriptions


-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1948357] [NEW] sshd have no USER_LOGOUT audit event

2021-10-21 Thread lizhijian
Public bug reported:

ubuntu 18.04

lizj@FNSTPC:~$ sudo aureport -e -i --summary | grep USER
43241  USER_END
16946  USER_START
16718  USER_ACCT
658  USER_AUTH
543  USER_CMD
255  USER_LOGIN
9  USER_ROLE_CHANGE
5  USER_ERR
2  USER_CHAUTHTOK
1  ADD_USER
lizj@FNSTPC:~/.local/bin$ dpkg -l | grep openssh
ii  openssh-client1:7.6p1-4ubuntu0.5
  amd64secure shell (SSH) client, for secure access 
to remote machines
ii  openssh-server1:7.6p1-4ubuntu0.5
  amd64secure shell (SSH) server, for secure access 
from remote machines
ii  openssh-sftp-server   1:7.6p1-4ubuntu0.5
  amd64secure shell (SSH) sftp server module, for 
SFTP access from remote machines
lizj@FNSTPC:~/.local/bin$ lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description:Ubuntu 18.04.6 LTS
Release:18.04
Codename:   bionic


while in my fedora 33 host, it includes USER_LOGOUT as below

fedora 33
[root@iaas-rpma linux]# aureport -e -i --summary | grep USER
7356  CRYPTO_KEY_USER
2103  USER_START
1649  USER_END
1268  USER_ACCT
1108  USER_ROLE_CHANGE
1029  USER_AUTH
895  USER_LOGIN
789  USER_LOGOUT
60  USER_CMD
14  USER_ERR
3  USER_MGMT
3  USER_CHAUTHTOK
1  ADD_USER
[root@iaas-rpma ~]# rpm -qa | grep openssh
openssh-8.4p1-1.1.fc33.x86_64
openssh-clients-8.4p1-1.1.fc33.x86_64
openssh-server-8.4p1-1.1.fc33.x86_64

** Affects: openssh (Ubuntu)
 Importance: Undecided
 Status: New

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1948357

Title:
  sshd have no USER_LOGOUT audit event

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/1948357/+subscriptions


-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs