Auditing in old versions of Linux

[Steve Grubb]

On Tuesday 30 March 2010 11:32:35 am Mario Chancay wrote:
> Due to technical and budget constrains, we are not yet able to migrate some
> old linux boxes to the latest versions but need to configure auditing
> under the following platforms :
> 
> - Red Hat Linux Enterprise AS 3.4, 3.5, 3.6
> - Red Hat Linux 4.x

Yes it is possible, but the auditing mechanisms are different. Both are common 
criteria certified. One of the requirements for common criteria is auditing.
 
> Need advice to confirm if auditing is possible under this versions and also
> the recommended procedure to install/setup as I understand that the auditd
> package depends on the kernel version. 

That is a longer topic. There are documents available in the cert rpm that may 
be able to help answer how you should set it up.

ftp://ftp.redhat.com/pub/redhat/linux/eal/

-Steve