[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: auid bug



Are you sure you have pam_loginuid.so configured in the appropriate
/etc/pam.d/* files, such as login and sshd?

I checked the login file and it matches yours, I am not using ssh on this machine.

I'm running the .41 kernel and the audit-1.2.4 tools and
the auid is correct in the audit records on my system.

Most of the time, mine is correct as well. It seems to occur sporadically. Usually, a reboot will fix the problem.

Steve


I am receiving audit events with an odd auid...  I am not sure if this
is something wrong in the kernel or in audit.  The auid I am receiving
is 4294967295 (the max value for an unsigned long).  The other uid/gid
information is normal.

I have seen this on all audit versions since audit-1.2.3, and noticed it
using the following kernels:

2.6.17-1.2293.2.2_FC6.lspp.38.i686
2.6.17-1.2293.2.2_FC6.lspp.44.i686

The first time I noticed this was after the filter_key patch I applied
to audit-1.2.3, but it may have nothing to do with that patch.  I
mentioned it then:

https://www.redhat.com/archives/linux-audit/2006-June/msg00086.html

There is an example record from the audit dispatcher there.

These events are coming straight from the real-time audit dispatcher.

Steve


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]