Strange behavior with pam_tty_audit

Strange behavior with pam_tty_audit

[Maupertuis Philippe]

[-- Attachment #1.1: Type: text/plain, Size: 1784 bytes --]

Hi
The auditd rules for PCI reads :
## 10.2.2 Log administrative action. To meet this, you need to enable tty
## logging. The pam config below should be placed into su and sudo pam stacks.
## session   required pam_tty_audit.so disable=* enable=root

I have noticed  that nothing happened unless I add in /etc/pam.d/sshd
session    required pam_tty_audit.so enable=*

At which point I get

Should it be done that way ?
Did I miss something ?

Philippe

!!!*************************************************************************************
"Ce message et les pi?ces jointes sont confidentiels et r?serv?s ? l'usage exclusif de ses destinataires. Il peut ?galement ?tre prot?g? par le secret professionnel. Si vous recevez ce message par erreur, merci d'en avertir imm?diatement l'exp?diteur et de le d?truire. L'int?grit? du message ne pouvant ?tre assur?e sur Internet, la responsabilit? de Worldline ne pourra ?tre recherch?e quant au contenu de ce message. Bien que les meilleurs efforts soient faits pour maintenir cette transmission exempte de tout virus, l'exp?diteur ne donne aucune garantie ? cet ?gard et sa responsabilit? ne saurait ?tre recherch?e pour tout dommage r?sultant d'un virus transmis.

This e-mail and the documents attached are confidential and intended solely for the addressee; it may also be privileged. If you receive this e-mail in error, please notify the sender immediately and destroy it. As its integrity cannot be secured on the Internet, the Worldline liability cannot be triggered for the message content. Although the sender endeavours to maintain a computer virus-free network, the sender does not warrant that this transmission is virus-free and will not be liable for any damages resulting from any virus transmitted.!!!"

[-- Attachment #1.2: Type: text/html, Size: 4608 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]

Re: Strange behavior with pam_tty_audit

[Steve Grubb]

Hello,

On Tuesday, November 14, 2017 8:29:34 AM EST Maupertuis Philippe wrote:
> The auditd rules for PCI reads :
> ## 10.2.2 Log administrative action. To meet this, you need to enable tty
> ## logging. The pam config below should be placed into su and sudo pam
> stacks. ## session   required pam_tty_audit.so disable=* enable=root
> 
> I have noticed  that nothing happened unless I add in /etc/pam.d/sshd
> session    required pam_tty_audit.so enable=*

If I understand, you deleted the 'disable=*' and replaced 'root' with '*'. 
That would be unusual. The command line is processed from left to right. So, 
what should happen in the original rule is disable auditing of all users, then 
enable auditing of only root. PCI wants administrative actions which would 
only be the root user.


> At which point I get
> 
> Should it be done that way ?
> Did I miss something ?

It works for me as specified in the PCI rules. (Tested using su.) Note that 
the kernel caches the keystrokes and you do not get a 1x1 mapping of events to 
commands entered. You will likely get multiple commands all strung together. 
It only creates the event when either it fills the buffer or the user ends the 
privileged session.

-Steve

RE: Strange behavior with pam_tty_audit

[Maupertuis Philippe]

> -----Message d'origine-----
> De : Steve Grubb [mailto:sgrubb@redhat.com]
> Envoyé : mardi 14 novembre 2017 14:53
> À : linux-audit@redhat.com
> Cc : Maupertuis Philippe
> Objet : Re: Strange behavior with pam_tty_audit
>
> Hello,
>
> On Tuesday, November 14, 2017 8:29:34 AM EST Maupertuis Philippe wrote:
> > The auditd rules for PCI reads :
> > ## 10.2.2 Log administrative action. To meet this, you need to enable
> > tty ## logging. The pam config below should be placed into su and sudo
> pam
> > stacks. ## session   required pam_tty_audit.so disable=* enable=root
> >
> > I have noticed  that nothing happened unless I add in /etc/pam.d/sshd
> > session    required pam_tty_audit.so enable=*
>
> If I understand, you deleted the 'disable=*' and replaced 'root' with '*'.
> That would be unusual. The command line is processed from left to right. So,
> what should happen in the original rule is disable auditing of all users, then
> enable auditing of only root. PCI wants administrative actions which would
> only be the root user.
>
>
> > At which point I get
> >
> > Should it be done that way ?
> > Did I miss something ?
>
> It works for me as specified in the PCI rules. (Tested using su.) Note that the
> kernel caches the keystrokes and you do not get a 1x1 mapping of events to
> commands entered. You will likely get multiple commands all strung
> together.
> It only creates the event when either it fills the buffer or the user ends the
> privileged session.
>
I tried with su instead of sudo and it works as indicated in the doc.
The same line in sudo doesn't work, it seems there is a bug with sudo
I am on redhat 7.4 if that matters
> -Steve

!!!*************************************************************************************
"Ce message et les pièces jointes sont confidentiels et réservés à l'usage exclusif de ses destinataires. Il peut également être protégé par le secret professionnel. Si vous recevez ce message par erreur, merci d'en avertir immédiatement l'expéditeur et de le détruire. L'intégrité du message ne pouvant être assurée sur Internet, la responsabilité de Worldline ne pourra être recherchée quant au contenu de ce message. Bien que les meilleurs efforts soient faits pour maintenir cette transmission exempte de tout virus, l'expéditeur ne donne aucune garantie à cet égard et sa responsabilité ne saurait être recherchée pour tout dommage résultant d'un virus transmis.

This e-mail and the documents attached are confidential and intended solely for the addressee; it may also be privileged. If you receive this e-mail in error, please notify the sender immediately and destroy it. As its integrity cannot be secured on the Internet, the Worldline liability cannot be triggered for the message content. Although the sender endeavours to maintain a computer virus-free network, the sender does not warrant that this transmission is virus-free and will not be liable for any damages resulting from any virus transmitted.!!!"