<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=us-ascii">
<META content="MSHTML 6.00.5730.11" name=GENERATOR></HEAD>
<BODY>
<DIV><FONT face=Arial size=2><SPAN
class=160060620-05112008>All,</SPAN></FONT></DIV>
<DIV><FONT face=Arial size=2><SPAN class=160060620-05112008>been google-ing all
day, so sorry if this info is common knowledge, but I can't seem to find
it. </SPAN></FONT></DIV>
<DIV><FONT face=Arial size=2><SPAN
class=160060620-05112008></SPAN></FONT> </DIV>
<DIV><FONT face=Arial size=2><SPAN class=160060620-05112008>Trying to build FC5
(2.6.20-1.2320-fc5) system to meet a sponsor requirement (miserable task
that it is), and I have to make this system be NISPOM compliant.
Unfortunately, ssh logout isn't showing up in my audit logs, and although I have
an idea why, I can't seem to find what I think I need ... The system I am
building has the following:</SPAN></FONT></DIV>
<DIV><FONT face=Arial size=2><SPAN
class=160060620-05112008></SPAN></FONT> </DIV>
<DIV><FONT face=Arial size=2><SPAN
class=160060620-05112008>OS
= FC5</SPAN></FONT></DIV>
<DIV><FONT face=Arial size=2><SPAN class=160060620-05112008>audit
subsystem = 1.3-2</SPAN></FONT></DIV>
<DIV><FONT face=Arial size=2><SPAN
class=160060620-05112008>openssh
= 4.3p2-4.12</SPAN></FONT></DIV>
<DIV><FONT face=Arial size=2><SPAN
class=160060620-05112008>kernel
= 2.6.20-1.2320-fc5</SPAN></FONT></DIV>
<DIV><FONT face=Arial size=2><SPAN
class=160060620-05112008></SPAN></FONT> </DIV>
<DIV><FONT face=Arial size=2><SPAN class=160060620-05112008>My RHEL4 systems
capture ssh logout just fine , and they are at earlier versions of both
openssh and the audit subsystem... I found a note from a colleague
about needing openssh >= 4.3p2-4.13 to fix the ssh logout problem
for (I think) SuSe 10.1, so I thought I'd try and find a later version of open
ssh or at least a src.rpm to build a newer version for fc5 , but I didn't
have much luck. Found a 4.3p2-16 src.rpm for el5, but of course, that didn't
build properly on my fc5 system . </SPAN></FONT></DIV>
<DIV><FONT face=Arial size=2><SPAN
class=160060620-05112008></SPAN></FONT> </DIV>
<DIV><FONT face=Arial size=2><SPAN class=160060620-05112008>Anyone know if I'm
chasing my tail? maybe something else will fix this for FC5 (newer audit
pkg? )? Recommendations would be most appreciated.
If you all think I DO need a newer openssh version, anyone know where I
can get a src.rpm for fc5 later than 4.3p2-4.12? </SPAN></FONT></DIV>
<DIV><FONT face=Arial size=2><SPAN
class=160060620-05112008></SPAN></FONT> </DIV>
<DIV><FONT face=Arial size=2><SPAN
class=160060620-05112008>Thanks,</SPAN></FONT></DIV>
<DIV><FONT face=Arial size=2><SPAN
class=160060620-05112008></SPAN></FONT> </DIV>
<DIV><FONT face=Arial size=2><SPAN class=160060620-05112008>Karen
Wieprecht</SPAN></FONT></DIV></BODY></HTML>