USER_MGMT event
MAUPERTUIS, PHILIPPE
philippe.maupertuis at equensworldline.com
Mon Jan 6 09:44:07 UTC 2020
Hi,
Below is the complete log of the session where I did :
1) remove all rules
2) change root's shell using chsh
3) ausearch
4) change root's shell using usermod
4 ausearch
There is no event at all for the chsh
Philippe
[root at xxxxxxxxx ~]# auditctl -D
No rules
[root at xxxxxxxxx ~]# getent passwd root
root:x:0:0:root at xxxxxxxxx:/root:/bin/bash
[root at xxxxxxxxx ~]# chsh -l
/bin/sh
/bin/bash
/usr/bin/sh
/usr/bin/bash
/usr/bin/tlog-rec-session
[root at xxxxxxxxx ~]# chsh -s /usr/bin/tlog-rec-session root
Changing shell for root.
Shell changed.
[root at xxxxxxxxx ~]# ausearch -ts recent -i
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.516:9514) : auid=u12345 ses=104 op=remove_rule key=(null) list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.516:9515) : auid=u12345 ses=104 op=remove_rule key=(null) list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.516:9516) : auid=u12345 ses=104 op=remove_rule key=(null) list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.521:9517) : auid=u12345 ses=104 op=remove_rule key=(null) list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.521:9518) : auid=u12345 ses=104 op=remove_rule key=(null) list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.521:9519) : auid=u12345 ses=104 op=remove_rule key=32bit-abi list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.521:9520) : auid=u12345 ses=104 op=remove_rule key=ignore_chrony list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.521:9521) : auid=u12345 ses=104 op=remove_rule key=10.2.1-cardholder-access list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.521:9522) : auid=u12345 ses=104 op=remove_rule key=10.2.3-access-audit-trail list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.521:9523) : auid=u12345 ses=104 op=remove_rule key=10.2.3-access-audit-trail list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.521:9524) : auid=u12345 ses=104 op=remove_rule key=10.2.3-access-audit-trail list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.521:9525) : auid=u12345 ses=104 op=remove_rule key=10.2.3-access-audit-trail list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.521:9526) : auid=u12345 ses=104 op=remove_rule key=10.2.3-access-audit-trail list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.521:9527) : auid=u12345 ses=104 op=remove_rule key=10.2.3-access-audit-trail list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9528) : auid=u12345 ses=104 op=remove_rule key=10.2.5.b-elevated-privs-session list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9529) : auid=u12345 ses=104 op=remove_rule key=10.2.5.b-elevated-privs-session list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9530) : auid=u12345 ses=104 op=remove_rule key=10.2.5.b-elevated-privs-setuid list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9531) : auid=u12345 ses=104 op=remove_rule key=10.2.5.b-elevated-privs-cmd list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9532) : auid=u12345 ses=104 op=remove_rule key=10.2.5.c-accounts list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9533) : auid=u12345 ses=104 op=remove_rule key=10.2.5.c-accounts list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9534) : auid=u12345 ses=104 op=remove_rule key=10.2.5.c-accounts list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9535) : auid=u12345 ses=104 op=remove_rule key=10.2.5.c-accounts list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9536) : auid=u12345 ses=104 op=remove_rule key=10.2.5.c-accounts list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9537) : auid=u12345 ses=104 op=remove_rule key=10.4.2b-time-change list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9538) : auid=u12345 ses=104 op=remove_rule key=10.4.2b-time-change list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9539) : auid=u12345 ses=104 op=remove_rule key=10.4.2b-time-change list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9540) : auid=u12345 ses=104 op=remove_rule key=10.5.5-modification-audit list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9541) : auid=u12345 ses=104 op=remove_rule key=10.2.7-module-load list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9542) : auid=u12345 ses=104 op=remove_rule key=10.2.7-module-load list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9543) : auid=u12345 ses=104 op=remove_rule key=10.2.7-module-unload list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9544) : auid=u12345 ses=104 op=remove_rule key=10.2.7-module-unload list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9545) : auid=u12345 ses=104 op=remove_rule key=external-access list=exit res=yes
[root at xxxxxxxxx ~]# usermod -s /bin/bash root
[root at xxxxxxxxx ~]# ausearch -ts recent -i
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.516:9514) : auid=u12345 ses=104 op=remove_rule key=(null) list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.516:9515) : auid=u12345 ses=104 op=remove_rule key=(null) list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.516:9516) : auid=u12345 ses=104 op=remove_rule key=(null) list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.521:9517) : auid=u12345 ses=104 op=remove_rule key=(null) list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.521:9518) : auid=u12345 ses=104 op=remove_rule key=(null) list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.521:9519) : auid=u12345 ses=104 op=remove_rule key=32bit-abi list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.521:9520) : auid=u12345 ses=104 op=remove_rule key=ignore_chrony list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.521:9521) : auid=u12345 ses=104 op=remove_rule key=10.2.1-cardholder-access list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.521:9522) : auid=u12345 ses=104 op=remove_rule key=10.2.3-access-audit-trail list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.521:9523) : auid=u12345 ses=104 op=remove_rule key=10.2.3-access-audit-trail list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.521:9524) : auid=u12345 ses=104 op=remove_rule key=10.2.3-access-audit-trail list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.521:9525) : auid=u12345 ses=104 op=remove_rule key=10.2.3-access-audit-trail list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.521:9526) : auid=u12345 ses=104 op=remove_rule key=10.2.3-access-audit-trail list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.521:9527) : auid=u12345 ses=104 op=remove_rule key=10.2.3-access-audit-trail list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9528) : auid=u12345 ses=104 op=remove_rule key=10.2.5.b-elevated-privs-session list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9529) : auid=u12345 ses=104 op=remove_rule key=10.2.5.b-elevated-privs-session list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9530) : auid=u12345 ses=104 op=remove_rule key=10.2.5.b-elevated-privs-setuid list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9531) : auid=u12345 ses=104 op=remove_rule key=10.2.5.b-elevated-privs-cmd list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9532) : auid=u12345 ses=104 op=remove_rule key=10.2.5.c-accounts list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9533) : auid=u12345 ses=104 op=remove_rule key=10.2.5.c-accounts list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9534) : auid=u12345 ses=104 op=remove_rule key=10.2.5.c-accounts list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9535) : auid=u12345 ses=104 op=remove_rule key=10.2.5.c-accounts list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9536) : auid=u12345 ses=104 op=remove_rule key=10.2.5.c-accounts list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9537) : auid=u12345 ses=104 op=remove_rule key=10.4.2b-time-change list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9538) : auid=u12345 ses=104 op=remove_rule key=10.4.2b-time-change list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9539) : auid=u12345 ses=104 op=remove_rule key=10.4.2b-time-change list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9540) : auid=u12345 ses=104 op=remove_rule key=10.5.5-modification-audit list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9541) : auid=u12345 ses=104 op=remove_rule key=10.2.7-module-load list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9542) : auid=u12345 ses=104 op=remove_rule key=10.2.7-module-load list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9543) : auid=u12345 ses=104 op=remove_rule key=10.2.7-module-unload list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9544) : auid=u12345 ses=104 op=remove_rule key=10.2.7-module-unload list=exit res=yes
----
node=xxxxxxxxx type=CONFIG_CHANGE msg=audit(01/06/2020 10:00:53.535:9545) : auid=u12345 ses=104 op=remove_rule key=external-access list=exit res=yes
----
node=xxxxxxxxx type=USER_MGMT msg=audit(01/06/2020 10:04:22.552:9546) : pid=6937 uid=root auid=u12345 ses=104 msg='op=changing-shell id=root exe=/usr/sbin/usermod hostname=xxxxxxxxx addr=? terminal=pts/0 res=success'
-----Message d'origine-----
De : Steve Grubb [mailto:sgrubb at redhat.com]
Envoyé : samedi 4 janvier 2020 22:12
À : linux-audit at redhat.com
Cc : MAUPERTUIS, PHILIPPE
Objet : Re: USER_MGMT event
On Monday, December 30, 2019 12:29:13 PM EST MAUPERTUIS, PHILIPPE wrote:
> On a RHEL8 server, when playing around with usermod and chsh, I noticed
> that usermod -c 'root at xxx' root generates a user_mgmt event
> But
> chsh -s /usr/bin/tlog-rec-session root didn't.
> Is that the expected behavior ?
It depends. Did you get any event at all? There is a chance that you just
have mismatching events.
> I was expecting an event for both.
There should be an event for both.
> Should I open a ticket at redhat for this ?
Let's see what the answer is for the above. But potentially yes. And if there
is any change we'll be sure to get this into upstream shadow-utils so its
uniform across all distros.
-Steve
equensWorldline is a registered trade mark and trading name owned by the Worldline Group through its holding company.
This e-mail and the documents attached are confidential and intended solely for the addressee. If you receive this e-mail in error, you are not authorized to copy, disclose, use or retain it. Please notify the sender immediately and delete this email from your systems. As emails may be intercepted, amended or lost, they are not secure. EquensWorldline and the Worldline Group therefore can accept no liability for any errors or their content. Although equensWorldline and the Worldline Group endeavours to maintain a virus-free network, we do not warrant that this transmission is virus-free and can accept no liability for any damages resulting from any virus transmitted. The risks are deemed to be accepted by everyone who communicates with equensWorldline and the Worldline Group by email
More information about the Linux-audit
mailing list