On Wednesday, September 6, 2017 9:42:53 AM EDT Maupertuis Philippe wrote: > Hi, > The examples found in the audit documentation mention that to work it is > assumed that no direct root login is allowed. This very sensible and not a > big problem except for console access.
Why is it a problem for console access? :-) > What would be the best way to monitor what is done through this access ? If you need to know the commands & changes made by root, then you probably need to use pam_tty_audit to enable tty auditing for su and sudo. > Would you recommend to forbid root access even in console ? Yes. Who is root? Who was root 4 years ago? By logging in with your account and then changing to root, the audit system can track who root is. The only time I can think of where you wouldn't want this tracking is when the system is in single user mode. (Because auditd doesn't normally start in single user mode.) -Steve > !!!************************************************************************* > ************ "Ce message et les pi?ces jointes sont confidentiels et > r?serv?s ? l'usage exclusif de ses destinataires. Il peut ?galement ?tre > prot?g? par le secret professionnel. Si vous recevez ce message par erreur, > merci d'en avertir imm?diatement l'exp?diteur et de le d?truire. > L'int?grit? du message ne pouvant ?tre assur?e sur Internet, la > responsabilit? de Worldline ne pourra ?tre recherch?e quant au contenu de > ce message. Bien que les meilleurs efforts soient faits pour maintenir > cette transmission exempte de tout virus, l'exp?diteur ne donne aucune > garantie ? cet ?gard et sa responsabilit? ne saurait ?tre recherch?e pour > tout dommage r?sultant d'un virus transmis. > > This e-mail and the documents attached are confidential and intended solely > for the addressee; it may also be privileged. If you receive this e-mail in > error, please notify the sender immediately and destroy it. As its > integrity cannot be secured on the Internet, the Worldline liability cannot > be triggered for the message content. Although the sender endeavours to > maintain a computer virus-free network, the sender does not warrant that > this transmission is virus-free and will not be liable for any damages > resulting from any virus transmitted.!!!" -- Linux-audit mailing list Linux-audit@redhat.com https://www.redhat.com/mailman/listinfo/linux-audit