[PATCH] auditd - TTY support for audisp-prelude

[Steve Grubb]

On Friday, June 17, 2011 11:10:41 AM Matteo Sessa wrote:
> Attached is a patch for auditd to add support for TTY audits (
> pam_tty_audit session module ) to audisp-prelude.
> 
> Alerts are reported with:
> alert.classification.text = "Keylogger"
> alert.assessment.impact.severity = LOW

Thanks for this contribution. I applied the patch with a couple minor revisions.


> and actual keystrokes carried on alert.additional_data.

Because of this ^^^ I am disabling it by default since I think you want to stop and 
consider if you really want keystrokes on your prelude database.


> Attached you will find also a basic python commandline script to query
> keylogger data from prelude database.

If there was a little more explanation of this script in its text, I would add it to 
the contrib section to preserve it.

Thanks,
-Steve