auditd not logging proper log.

[Rakesh Kumar]

Hi Team,

1)I am using this version of auditctl version 2.4.4 . So does this version has the user login/logout info to log into audit.log ?

2) If u  to want to see the pam.d/login file configuration to check why its not logging the login/logout info then please let me know about this , i will be happy to share that file.or if it needs other pam file to check also please let me know that also.
As i see in my system that [kauditd] is running so it log all login info.
Please help me on this .
Regards,Rakesh    On Thursday, July 29, 2021, 09:49:03 PM GMT+5:30, Steve Grubb <sgrubb at redhat.com> wrote:  
 
 On Thursday, July 29, 2021 4:19:16 AM EDT Rakesh Kumar wrote:
> I did not get you, in kernel auditd is enabled like kauditd is running then
> what exactly we have to do changes in my system to get full login n log
> out info in audit. Log file.  

Logging in/out is done in 2 places. First, pam records what it knows. But the 
entry point daemon is also supposed to send USER_LOGIN and USER_LOGOUT 
events.

Complete information is here:
https://github.com/linux-audit/audit-documentation/wiki/SPEC-User-Login-Lifecycle-Events

Gdm, Kdm, and sshd all have been updated to record these events. All that is 
needed is to configure --with-audit during the package build. By now, I would 
expect all distros to do that.

-Steve


>  On Sat, Jul 10, 2021 at 19:57, Steve Grubb<sgrubb at redhat.com> wrote:  On 
Saturday, July 10, 2021 2:28:55 AM EDT Rakesh Kumar wrote:
> > 1)I am trying to run the auditd (start/stop)  without root user as normal
> > user , how to achieve this on linux.?
> 
> For security reasons, this is not allowed.
> 
> > 2)i am using kernel version 4.19.97 and i am not getting any
> > login/logout,
> > authentication fail/pass log data in audit.log file. DOes it need any
> > changes in the config or rules..
> 
> This is hardwired into pam. The rules don't matter. I'd check that pam was
> compiled with audit support and that audit is enabled in the kernel.
> 
> -Steve




  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/linux-audit/attachments/20210807/06ca5e00/attachment.htm>