auditd and SSHD exported variables

[Guillaume L.]

Hello,

Is there a way to log with auditd exported variables through ssd ?

My servers are used by many users but with the same account. So, I export
the SSH_USER variable from our "bastion" (where each user has a specific
account). With this configuration I can retrieve the remote login.

I use this script in /etc/profile.d/:


logger -p local0.notice "`date` ": Connection from $SSH_USER@`echo
$SSH_CONNECTION | cut -d " " -f1`":"`echo $SSH_CONNECTION | cut -d " " -f2`
for $USER

($SSH_USER is the variable exported via SSHD)

The ultimate goal is to match the following log with the "remote user"
(because all users use the uid 1000 to connect to the server):

type=SYSCALL msg=audit(1431694892.457:37824): arch=c000003e syscall=59
success=yes exit=0 a0=14cea68 a1=1423a48 a2=1553008 a3=0 items=2 ppid=30894
pid=30947 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0
tty=pts3 ses=17 comm="ls" exe="/bin/ls" key="auditcmd"
type=EXECVE msg=audit(1431694892.457:37824): argc=1 a0="ls"

type=CWD msg=audit(1431694892.457:37824):  cwd="/root"

type=PATH msg=audit(1431694892.457:37824): item=0 name="/bin/ls" inode=157
dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
type=PATH msg=audit(1431694892.457:37824): item=1 name=(null) inode=4212
dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
type=PROCTITLE msg=audit(1431694892.457:37824): proctitle="ls"

Thank you in advance.

Regards,

--
Guillaume
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/linux-audit/attachments/20150515/bc2b5962/attachment.htm>