(no subject)
Bill Tangren
bjt at aa.usno.navy.mil
Thu Mar 15 21:15:04 UTC 2007
Kirkwood, David A. wrote:
> When I view the events related to xscreensaver for a locked screen I
> get 2 separate audit entries, one for a failure and 1 as a success. Both
> have the same uid, euid, etc. Actually, the entries are exactly the same
> except for the event number and the success outcome. I have the
> xscreensaver executable set -rwsr-xr-x.
>
>
>
>
The failure may be due to xscreensaver not being able to write to the faillog,
if you are using pam_tally (to implement three strikes and you are locked out),
but I'm just guessing.
More information about the Linux-audit
mailing list