<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <meta name="Generator" content="Microsoft Word 15 (filtered medium)"> <style></style> </head> <body lang="EN-US" link="blue" vlink="purple"> <div class="WordSection1"> Warren, I missed this part of your message. <o:p></o:p> <o:p> </o:p> <div> >> This is an interesting topic.<o:p></o:p> <div> >> Please, can you tell me what audit rule you are using that generates such records about root's (or any other account's) password change?<o:p></o:p> <o:p> </o:p> I double checked the rules on a different RHEL 7.9 system , and it looks like we are only picking up password change attempts for accts in the user space, but not root, so if the password was changed directly from a root login rather than via sudo from another acct, we probably won’t see some of the related audit records.<o:p></o:p> <o:p> </o:p> This is the rule I believe is picking up password change events: <o:p></o:p> –a always,exit –F path=/usr/bin/passwd –F per=x –F auid>=1000 auid!=4294967295 –k privileged passwd<o:p></o:p> <o:p> </o:p> <o:p> </o:p> There are also a specific watches on /etc/shadow and gshadow:<o:p></o:p> -w /etc/shadow –p wa –k identity<o:p></o:p> <o:p> </o:p> I just attempted , from a non-priv acct, to change the root passwd, and I see the following relevant audit records key-value pairs :<o:p></o:p> <o:p> </o:p> This shows I successfully ran the passwd command and that the root acct was targeted , <o:p></o:p> type=PROCTITLE ... proctitle=passwd root ... <o:p></o:p> type=PATH name=/usr/bin/passwd <o:p></o:p> type=SYSCALL ... comm=passwd exe=/usr/bin/passwd success=yes key=setuid<o:p></o:p> <o:p> </o:p> This shows that a password change was attempted and failed, but doesn’t seem to correctly indicate that the root acct was targeted (id=myusername, not root): <o:p></o:p> Type=USER_CHAUTHOK auid=myusername msg=’op=attempted-to-change-password id=myusername exe=/usr/bin/passwd res=failed<o:p></o:p> <o:p> </o:p> So... based on this, unless the patch versions are a bit different between the two RHEL7.9 systems I’ve been looking at, it looks like you are actually generating a reasonable message when a password change is attempted, but we probably need to make sure we are picking up all password changes, not just those in the user space. <o:p></o:p> <o:p> </o:p> I unfortunately don’t have permission to change the audit rules, but will see if I can the SA to test this for me. If you are able to test in your environment and can confirm my findings, that would be wonderful, but I think we probably found our smoking gun, LOL. <o:p></o:p> <o:p> </o:p> Thanks so much,<o:p></o:p> Karen Wiepecht <o:p></o:p> </div> </div> </div> </body> </html>