On Sunday 07 December 2008 12:11:04 Jesse Keating wrote: > But only through pre-approved interfaces... what if the admin doesn't > use any of those for their first attempts? (why would an admin use any > of those?) That's where audit by tty comes into play. Check out pam_tty_audit. -Steve