From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Henning, Arthur C. (CSL)" Subject: (no subject) Date: Sat, 18 Aug 2007 12:02:04 -0500 Message-ID: <6F2A8C9C4C5BE446A17B745BBC856EEB5A6D27@XMBTX113.northgrum.com> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============0581706068==" Return-path: Received: from mx1.redhat.com (mx1.redhat.com [172.16.48.31]) by int-mx1.corp.redhat.com (8.13.1/8.13.1) with ESMTP id l7IH2FO8005573 for ; Sat, 18 Aug 2007 13:02:15 -0400 Received: from xmrt0101.northgrum.com (xmrt0101.northgrum.com [208.20.220.55]) by mx1.redhat.com (8.13.1/8.13.1) with ESMTP id l7IH2ARu009258 for ; Sat, 18 Aug 2007 13:02:10 -0400 Content-class: urn:content-classes:message List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com This is a multi-part message in MIME format. --===============0581706068== Content-class: urn:content-classes:message Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C7E1B9.80A18CDA" This is a multi-part message in MIME format. ------_=_NextPart_001_01C7E1B9.80A18CDA Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable RHEL 5 Have two events having difficulty capturing or reviewing with the audit sub-system. 1. su - "non_existent_account". Using the nispom.rules provided by audit 1.5.6-1. Using various ausearch parameters, am unable to find a corresponding failure when attempting to "su" to a non-existent account. 2. Non-privileged user attempting to change the date/time on the server. Of course the user fails to be able to do so, but am unable to capture or review the event. Not sure if these are audit rule configuration or search unknowns or audit sub-system limitations. Thank you Art Henning (CSL)=20 Enterprise IT Solutions Northrop Grumman Corporation art.henning@ngc.com ------_=_NextPart_001_01C7E1B9.80A18CDA Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

RHEL 5

Have two events having difficulty = capturing or reviewing with the audit sub-system.

1. su - = "non_existent_account". Using the nispom.rules provided by = audit 1.5.6-1. Using various ausearch parameters, am unable to find a = corresponding failure when attempting to "su" to a = non-existent account.

2. Non-privileged user attempting to = change the date/time on the server. Of course the user fails to be able = to do so, but am unable to capture or review the event.

Not sure if these are audit rule = configuration or search unknowns or audit sub-system limitations.

Thank you
Art Henning (CSL)
Enterprise IT Solutions
Northrop Grumman Corporation
art.henning@ngc.com

------_=_NextPart_001_01C7E1B9.80A18CDA-- --===============0581706068== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============0581706068==--