Discussion:
Strange behavior with pam_tty_audit
(too old to reply)
Maupertuis Philippe
2017-11-14 13:29:34 UTC
Permalink
Raw Message
Hi
The auditd rules for PCI reads :
## 10.2.2 Log administrative action. To meet this, you need to enable tty
## logging. The pam config below should be placed into su and sudo pam stacks.
## session required pam_tty_audit.so disable=* enable=root

I have noticed that nothing happened unless I add in /etc/pam.d/sshd
session required pam_tty_audit.so enable=*

At which point I get

Should it be done that way ?
Did I miss something ?

Philippe

!!!*************************************************************************************
"Ce message et les pi?ces jointes sont confidentiels et r?serv?s ? l'usage exclusif de ses destinataires. Il peut ?galement ?tre prot?g? par le secret professionnel. Si vous recevez ce message par erreur, merci d'en avertir imm?diatement l'exp?diteur et de le d?truire. L'int?grit? du message ne pouvant ?tre assur?e sur Internet, la responsabilit? de Worldline ne pourra ?tre recherch?e quant au contenu de ce message. Bien que les meilleurs efforts soient faits pour maintenir cette transmission exempte de tout virus, l'exp?diteur ne donne aucune garantie ? cet ?gard et sa responsabilit? ne saurait ?tre recherch?e pour tout dommage r?sultant d'un virus transmis.

This e-mail and the documents attached are confidential and intended solely for the addressee; it may also be privileged. If you receive this e-mail in error, please notify the sender immediately and destroy it. As its integrity cannot be secured on the Internet, the Worldline liability cannot be triggered for the message content. Although the sender endeavours to maintain a computer virus-free network, the sender does not warrant that this transmission is virus-free and will not be liable for any damages resulting from any virus transmitted.!!!"
Steve Grubb
2017-11-14 13:53:02 UTC
Permalink
Raw Message
Hello,
Post by Maupertuis Philippe
## 10.2.2 Log administrative action. To meet this, you need to enable tty
## logging. The pam config below should be placed into su and sudo pam
stacks. ## session required pam_tty_audit.so disable=* enable=root
I have noticed that nothing happened unless I add in /etc/pam.d/sshd
session required pam_tty_audit.so enable=*
If I understand, you deleted the 'disable=*' and replaced 'root' with '*'.
That would be unusual. The command line is processed from left to right. So,
what should happen in the original rule is disable auditing of all users, then
enable auditing of only root. PCI wants administrative actions which would
only be the root user.
Post by Maupertuis Philippe
At which point I get
Should it be done that way ?
Did I miss something ?
It works for me as specified in the PCI rules. (Tested using su.) Note that
the kernel caches the keystrokes and you do not get a 1x1 mapping of events to
commands entered. You will likely get multiple commands all strung together.
It only creates the event when either it fills the buffer or the user ends the
privileged session.

-Steve
Maupertuis Philippe
2017-11-14 15:47:39 UTC
Permalink
Raw Message
-----Message d'origine-----
Envoyé : mardi 14 novembre 2017 14:53
Cc : Maupertuis Philippe
Objet : Re: Strange behavior with pam_tty_audit
Hello,
Post by Maupertuis Philippe
## 10.2.2 Log administrative action. To meet this, you need to enable
tty ## logging. The pam config below should be placed into su and sudo
pam
Post by Maupertuis Philippe
stacks. ## session required pam_tty_audit.so disable=* enable=root
I have noticed that nothing happened unless I add in /etc/pam.d/sshd
session required pam_tty_audit.so enable=*
If I understand, you deleted the 'disable=*' and replaced 'root' with '*'.
That would be unusual. The command line is processed from left to right. So,
what should happen in the original rule is disable auditing of all users, then
enable auditing of only root. PCI wants administrative actions which would
only be the root user.
Post by Maupertuis Philippe
At which point I get
Should it be done that way ?
Did I miss something ?
It works for me as specified in the PCI rules. (Tested using su.) Note that the
kernel caches the keystrokes and you do not get a 1x1 mapping of events to
commands entered. You will likely get multiple commands all strung together.
It only creates the event when either it fills the buffer or the user ends the
privileged session.
I tried with su instead of sudo and it works as indicated in the doc.
The same line in sudo doesn't work, it seems there is a bug with sudo
I am on redhat 7.4 if that matters
-Steve
!!!*************************************************************************************
"Ce message et les pièces jointes sont confidentiels et réservés à l'usage exclusif de ses destinataires. Il peut également être protégé par le secret professionnel. Si vous recevez ce message par erreur, merci d'en avertir immédiatement l'expéditeur et de le détruire. L'intégrité du message ne pouvant être assurée sur Internet, la responsabilité de Worldline ne pourra être recherchée quant au contenu de ce message. Bien que les meilleurs efforts soient faits pour maintenir cette transmission exempte de tout virus, l'expéditeur ne donne aucune garantie à cet égard et sa responsabilité ne saurait être recherchée pour tout dommage résultant d'un virus transmis.

This e-mail and the documents attached are confidential and intended solely for the addressee; it may also be privileged. If you receive this e-mail in error, please notify the sender immediately and destroy it. As its integrity cannot be secured on the Internet, the Worldline liability cannot be triggered for the message content. Although the sender endeavours to maintain a computer virus-free network, the sender does not warrant that this transmission is virus-free and will not be liable for any damages resulting from any virus transmitted.!!!"
Loading...