On Thursday, September 7, 2017 4:04:39 AM EDT Maupertuis Philippe wrote: > > -----Original Message----- > > From: Steve Grubb [mailto:sgr...@redhat.com] > > Sent: Wednesday, September 06, 2017 8:13 PM > > To: linux-audit@redhat.com > > Cc: Maupertuis Philippe > > Subject: Re: Auditing console access > > > > On Wednesday, September 6, 2017 9:42:53 AM EDT Maupertuis Philippe > > > > wrote: > > > Hi, > > > The examples found in the audit documentation mention that to work it > > > is assumed that no direct root login is allowed. This very sensible > > > and not a big problem except for console access. > > > > Why is it a problem for console access? :-) > > All people account are managed in a ldap, only root has a password and can > be used in last resort. The most obvious case in when something is wrong > with sssd, letting us with only local users. We could set up a local > account for that purpose but it wouldn't fit easily with PCI-DSS. > > > > What would be the best way to monitor what is done through this access ? > > Is there a way to get a specific information when this access is used ? > Maybe not all what was done but at least that someone used this entry.
The aulast program gives you session information. If you tell it --proof, then it will give you the ausearch command to isolate the session's events. -Steve > > If you need to know the commands & changes made by root, then you > > probably need to use pam_tty_audit to enable tty auditing for su and sudo. > > > > > Would you recommend to forbid root access even in console ? > > > > Yes. Who is root? Who was root 4 years ago? By logging in with your > > account > > and then changing to root, the audit system can track who root is. The > > only > > time I can think of where you wouldn't want this tracking is when the > > system is in single user mode. (Because auditd doesn't normally start in > > single user mode.) > > > > -Steve > > > > > > !!!******************************************************** > > *********** > > > > > ****** > > > ************ "Ce message et les pi?ces jointes sont confidentiels et > > > r?serv?s ? l'usage exclusif de ses destinataires. Il peut ?galement > > > ?tre prot?g? par le secret professionnel. Si vous recevez ce message > > > par erreur, merci d'en avertir imm?diatement l'exp?diteur et de le > > > d?truire. L'int?grit? du message ne pouvant ?tre assur?e sur Internet, > > > la > > > responsabilit? de Worldline ne pourra ?tre recherch?e quant au contenu > > > de ce message. Bien que les meilleurs efforts soient faits pour > > > maintenir cette transmission exempte de tout virus, l'exp?diteur ne > > > donne aucune garantie ? cet ?gard et sa responsabilit? ne saurait ?tre > > > recherch?e pour tout dommage r?sultant d'un virus transmis. > > > > > > This e-mail and the documents attached are confidential and intended > > > solely for the addressee; it may also be privileged. If you receive > > > this e-mail in error, please notify the sender immediately and destroy > > > it. As its integrity cannot be secured on the Internet, the Worldline > > > liability cannot be triggered for the message content. Although the > > > sender endeavours to maintain a computer virus-free network, the > > > sender does not warrant that this transmission is virus-free and will > > > not be liable for any damages resulting from any virus transmitted.!!!" > > !!!************************************************************************* > ************ "Ce message et les pièces jointes sont confidentiels et > réservés à l'usage exclusif de ses destinataires. Il peut également être > protégé par le secret professionnel. Si vous recevez ce message par erreur, > merci d'en avertir immédiatement l'expéditeur et de le détruire. > L'intégrité du message ne pouvant être assurée sur Internet, la > responsabilité de Worldline ne pourra être recherchée quant au contenu de > ce message. Bien que les meilleurs efforts soient faits pour maintenir > cette transmission exempte de tout virus, l'expéditeur ne donne aucune > garantie à cet égard et sa responsabilité ne saurait être recherchée pour > tout dommage résultant d'un virus transmis. > > This e-mail and the documents attached are confidential and intended solely > for the addressee; it may also be privileged. If you receive this e-mail in > error, please notify the sender immediately and destroy it. As its > integrity cannot be secured on the Internet, the Worldline liability cannot > be triggered for the message content. Although the sender endeavours to > maintain a computer virus-free network, the sender does not warrant that > this transmission is virus-free and will not be liable for any damages > resulting from any virus transmitted.!!!" > > -- > Linux-audit mailing list > Linux-audit@redhat.com > https://www.redhat.com/mailman/listinfo/linux-audit -- Linux-audit mailing list Linux-audit@redhat.com https://www.redhat.com/mailman/listinfo/linux-audit