Which userspace packages modified for audit
Steve Grubb
sgrubb at redhat.com
Sun Feb 25 19:40:57 UTC 2007
On Sunday 25 February 2007 13:41:56 Marcus Meissner wrote:
> Most of them have just support for emitting USER_LOGIN audit records.
>
> Are these necessary, because PAM emits USER_START / USER_END records
> anyway...
Yes. NISPOM is concerned about tracking login/logout. How do you distinguish
an actual login/logout vs the start of a session with the pam records? su and
cron, for example, do not do an actual login yet they create those records.
-Steve
More information about the Linux-audit
mailing list