Strange behavior with pam_tty_audit

[Maupertuis Philippe]

> -----Message d'origine-----
> De : Steve Grubb [mailto:sgrubb at redhat.com]
> Envoyé : mardi 14 novembre 2017 14:53
> À : linux-audit at redhat.com
> Cc : Maupertuis Philippe
> Objet : Re: Strange behavior with pam_tty_audit
>
> Hello,
>
> On Tuesday, November 14, 2017 8:29:34 AM EST Maupertuis Philippe wrote:
> > The auditd rules for PCI reads :
> > ## 10.2.2 Log administrative action. To meet this, you need to enable
> > tty ## logging. The pam config below should be placed into su and sudo
> pam
> > stacks. ## session   required pam_tty_audit.so disable=* enable=root
> >
> > I have noticed  that nothing happened unless I add in /etc/pam.d/sshd
> > session    required pam_tty_audit.so enable=*
>
> If I understand, you deleted the 'disable=*' and replaced 'root' with '*'.
> That would be unusual. The command line is processed from left to right. So,
> what should happen in the original rule is disable auditing of all users, then
> enable auditing of only root. PCI wants administrative actions which would
> only be the root user.
>
>
> > At which point I get
> >
> > Should it be done that way ?
> > Did I miss something ?
>
> It works for me as specified in the PCI rules. (Tested using su.) Note that the
> kernel caches the keystrokes and you do not get a 1x1 mapping of events to
> commands entered. You will likely get multiple commands all strung
> together.
> It only creates the event when either it fills the buffer or the user ends the
> privileged session.
>
I tried with su instead of sudo and it works as indicated in the doc.
The same line in sudo doesn't work, it seems there is a bug with sudo
I am on redhat 7.4 if that matters
> -Steve

!!!*************************************************************************************
"Ce message et les pièces jointes sont confidentiels et réservés à l'usage exclusif de ses destinataires. Il peut également être protégé par le secret professionnel. Si vous recevez ce message par erreur, merci d'en avertir immédiatement l'expéditeur et de le détruire. L'intégrité du message ne pouvant être assurée sur Internet, la responsabilité de Worldline ne pourra être recherchée quant au contenu de ce message. Bien que les meilleurs efforts soient faits pour maintenir cette transmission exempte de tout virus, l'expéditeur ne donne aucune garantie à cet égard et sa responsabilité ne saurait être recherchée pour tout dommage résultant d'un virus transmis.

This e-mail and the documents attached are confidential and intended solely for the addressee; it may also be privileged. If you receive this e-mail in error, please notify the sender immediately and destroy it. As its integrity cannot be secured on the Internet, the Worldline liability cannot be triggered for the message content. Although the sender endeavours to maintain a computer virus-free network, the sender does not warrant that this transmission is virus-free and will not be liable for any damages resulting from any virus transmitted.!!!"