On Thursday, July 29, 2021 4:19:16 AM EDT Rakesh Kumar wrote: > I did not get you, in kernel auditd is enabled like kauditd is running then > what exactly we have to do changes in my system to get full login n log > out info in audit. Log file.
Logging in/out is done in 2 places. First, pam records what it knows. But the entry point daemon is also supposed to send USER_LOGIN and USER_LOGOUT events. Complete information is here: https://github.com/linux-audit/audit-documentation/wiki/SPEC-User-Login-Lifecycle-Events Gdm, Kdm, and sshd all have been updated to record these events. All that is needed is to configure --with-audit during the package build. By now, I would expect all distros to do that. -Steve > On Sat, Jul 10, 2021 at 19:57, Steve Grubb<sgr...@redhat.com> wrote: On Saturday, July 10, 2021 2:28:55 AM EDT Rakesh Kumar wrote: > > 1)I am trying to run the auditd (start/stop) without root user as normal > > user , how to achieve this on linux.? > > For security reasons, this is not allowed. > > > 2)i am using kernel version 4.19.97 and i am not getting any > > login/logout, > > authentication fail/pass log data in audit.log file. DOes it need any > > changes in the config or rules.. > > This is hardwired into pam. The rules don't matter. I'd check that pam was > compiled with audit support and that audit is enabled in the kernel. > > -Steve -- Linux-audit mailing list Linux-audit@redhat.com https://listman.redhat.com/mailman/listinfo/linux-audit
