sudo false negative in audit trails
Steve Grubb
sgrubb at redhat.com
Wed Sep 19 15:12:50 UTC 2007
On Wednesday 19 September 2007 10:24:04 Todd, Charles wrote:
> I'm chasing down a false negative I'm getting in my ausearch output
> which makes it look like successful sudo access results in a failed
> CRED_ACQ record. Is anyone else seeing this? I'm going to list out my
> system specs, but please actually look at a sudo run in your system (if
> similar) before writing off my non-standard pieces:
> - RHEL4u4 (2.6.9.-42.0.2)
> - audit-1.0.15
> - quest-sudo-1.6.8p12q76
> - pam 0.77-66.17
>
> Command:
> # ausearch -m CRED_ACQ |grep sudo |tail -1
> type=CRED_ACQ msg=audit(1190207432.508:168552): user pid=13971 uid=0
> auid=1110 msg='PAM setcred: user=root exe="/opt/quest/bin/sudo"
> (hostname=?, addr=?, terminal=pts/1 result=Permission denied)'
This is not a false negative. This is pam telling you that something in the
auth section failed. It may be configured to be ignored by pam, but it really
did fail.
> They're all like that. Remember - the sudo actually granted me access
> as requested.
>
> /etc/pam.d/sudo looks like this, as generated by quest-sudo:
> auth [ignore=ignore success=done default=die] pam_vas3.so create_homedir
^^^ this is the likely guilty party.
> account [ignore=ignore success=done default=die] pam_vas3.so
> password [ignore=ignore success=done default=die] pam_vas3.so
> session [ignore=ignore success=done default=die] pam_vas3.so
> create_homedir
>
> I've reviewed the base sudo package source code and could find no
> changelog entries to the part that tells PAM whether or not success was
> made.
I'd review how it handles failed calls to pam_setcred and whether the module
properly supports pam_sm_setcred function.
> I know that sudo has to tell PAM who tells auditd whether or not
> VAS authenticated the user. Sudo works just find though - it's only the
> auditing which is squirelly.
pam does it all. The question really is the pam module working right?
> As for PAM, well, 0.77 is very old,
But very well audited for bugs. :)
-Steve
More information about the Linux-audit
mailing list