* AUDIT_LOGIN vs AUDIT_USER_LOGIN
@ 2015-07-31 13:59 Satish Chandra Kilaru
2015-07-31 14:12 ` Satish Chandra Kilaru
2015-07-31 14:19 ` Steve Grubb
0 siblings, 2 replies; 4+ messages in thread
From: Satish Chandra Kilaru @ 2015-07-31 13:59 UTC (permalink / raw)
To: linux-audit
[-- Attachment #1.1: Type: text/plain, Size: 136 bytes --]
I see AUDIT_USER_LOGIN when I ssh to a linux machine. What action will
cause AUDIT_LOGIN event?
--
Please Donate to www.wikipedia.org
[-- Attachment #1.2: Type: text/html, Size: 313 bytes --]
[-- Attachment #2: Type: text/plain, Size: 0 bytes --]
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: AUDIT_LOGIN vs AUDIT_USER_LOGIN
2015-07-31 13:59 AUDIT_LOGIN vs AUDIT_USER_LOGIN Satish Chandra Kilaru
@ 2015-07-31 14:12 ` Satish Chandra Kilaru
2015-07-31 14:19 ` Steve Grubb
1 sibling, 0 replies; 4+ messages in thread
From: Satish Chandra Kilaru @ 2015-07-31 14:12 UTC (permalink / raw)
To: linux-audit
[-- Attachment #1.1: Type: text/plain, Size: 423 bytes --]
It just means Audit Login Context is set...
http://lxr.free-electrons.com/source/kernel/auditsc.c#L1991
I actually see that event when I ssh.
On Fri, Jul 31, 2015 at 9:59 AM, Satish Chandra Kilaru <iam.kilaru@gmail.com
> wrote:
>
> I see AUDIT_USER_LOGIN when I ssh to a linux machine. What action will
> cause AUDIT_LOGIN event?
>
> --
> Please Donate to www.wikipedia.org
>
--
Please Donate to www.wikipedia.org
[-- Attachment #1.2: Type: text/html, Size: 1105 bytes --]
[-- Attachment #2: Type: text/plain, Size: 0 bytes --]
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: AUDIT_LOGIN vs AUDIT_USER_LOGIN
2015-07-31 13:59 AUDIT_LOGIN vs AUDIT_USER_LOGIN Satish Chandra Kilaru
2015-07-31 14:12 ` Satish Chandra Kilaru
@ 2015-07-31 14:19 ` Steve Grubb
2015-07-31 14:20 ` Satish Chandra Kilaru
1 sibling, 1 reply; 4+ messages in thread
From: Steve Grubb @ 2015-07-31 14:19 UTC (permalink / raw)
To: linux-audit
On Friday, July 31, 2015 09:59:13 AM Satish Chandra Kilaru wrote:
> I see AUDIT_USER_LOGIN when I ssh to a linux machine.
This means an interactive login session has been started by the user. This is
in contract to a cron job which does not create this event.
> What action will cause AUDIT_LOGIN event?
This means that the loginuid was set. Even a cron job will do this.
-Steve
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: AUDIT_LOGIN vs AUDIT_USER_LOGIN
2015-07-31 14:19 ` Steve Grubb
@ 2015-07-31 14:20 ` Satish Chandra Kilaru
0 siblings, 0 replies; 4+ messages in thread
From: Satish Chandra Kilaru @ 2015-07-31 14:20 UTC (permalink / raw)
To: Steve Grubb; +Cc: linux-audit
[-- Attachment #1.1: Type: text/plain, Size: 535 bytes --]
Thank you.
On Fri, Jul 31, 2015 at 10:19 AM, Steve Grubb <sgrubb@redhat.com> wrote:
> On Friday, July 31, 2015 09:59:13 AM Satish Chandra Kilaru wrote:
> > I see AUDIT_USER_LOGIN when I ssh to a linux machine.
>
> This means an interactive login session has been started by the user. This
> is
> in contract to a cron job which does not create this event.
>
> > What action will cause AUDIT_LOGIN event?
>
> This means that the loginuid was set. Even a cron job will do this.
>
> -Steve
>
>
--
Please Donate to www.wikipedia.org
[-- Attachment #1.2: Type: text/html, Size: 1095 bytes --]
[-- Attachment #2: Type: text/plain, Size: 0 bytes --]
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2015-07-31 14:20 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2015-07-31 13:59 AUDIT_LOGIN vs AUDIT_USER_LOGIN Satish Chandra Kilaru
2015-07-31 14:12 ` Satish Chandra Kilaru
2015-07-31 14:19 ` Steve Grubb
2015-07-31 14:20 ` Satish Chandra Kilaru
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.