From: Willi Mann <[EMAIL PROTECTED]>
Are you sure that the deletion of the group is covered? I only see Deleted
Users, not Deleted Groups in your report. I think this is another spelling
issue, the secure script contains the string "remove group" instead of
"removed group".
Ah yes, I wasn't paying close enough attention. Good spot.
Can you send me the full loglines, so I can pass them to the script for
testing? You will find them in /var/log/auth.log.
Mar 5 17:00:35 localhost userdel[29009]: delete user `asterisk'
Mar 5 17:00:35 localhost userdel[29009]: delete `asterisk' from group
`dialout'
Mar 5 17:00:35 localhost userdel[29009]: delete `asterisk' from group
`audio'
Mar 5 17:00:35 localhost userdel[29009]: removed group `asterisk' owned by
`asterisk'
Mar 5 17:00:35 localhost userdel[29009]: delete `asterisk' from shadow
group `dialout'
Mar 5 17:00:35 localhost userdel[29009]: delete `asterisk' from shadow
group `audio'
Mar 5 17:03:51 localhost su[28967]: (pam_unix) session closed for user root
Mar 5 17:04:22 localhost sudo: raburton : TTY=pts/1 ; PWD=/home/raburton ;
USER=root ; COMMAND=/usr/bin/apt-get install asterisk
Mar 5 17:04:28 localhost groupadd[29161]: new group: name=asterisk, GID=106
Mar 5 17:04:29 localhost useradd[29162]: new user: name=asterisk, UID=104,
GID=106, home=/var/lib/asterisk, shell=/bin/false
Mar 5 17:04:29 localhost chage[29163]: changed password expiry for asterisk
Mar 5 17:04:29 localhost chfn[29164]: changed user `asterisk' information
Mar 5 17:04:29 localhost gpasswd[29166]: set members of audio to asterisk
Mar 5 17:04:30 localhost gpasswd[29168]: set members of dialout to asterisk
Mar 5 17:04:44 localhost sudo: raburton : TTY=pts/1 ; PWD=/home/raburton ;
USER=root ; COMMAND=/etc/init.d/asterisk start
Richard.
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
