Hi,
I've got auditing running pretty well on Fedora and looks like SuSE as well, but
RHEL 4 is giving me some problems.
I'm working off of RHEL 4 with the following updated packages:
kernel-smp-2.6.9-55.EL.x86_64
kernel-smp-devel-2.6.9-55.EL.x86_64
glibc-kernheaders-2.4_9.1.100.EL.x86_64
audit-libs-1.0.15-3.EL4.x86_64
audit-1.0.15-3.EL4.x86_64
All other packages are at the original RHEL4 distribution level.
I'm seeing SYSCALL events, but no login/logout/su/ssh events. Steve had earlier
mentioned that login/logout/ssh/gdm events are managed by the pam modules. Are
there other packages I need to update to get login/logout events working?
As an extra topic, what is the maturity of RHEL5 w/ regard to auditing?
Bob Evans
JHU/APL
--
Linux-audit mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/linux-audit
