Re: pam_tty_audit doesn't work. Alternatives?
Hi.
On Wed, Dec 14, 2016 at 08:53:11AM -0300, info info wrote:
> Hi, setting
>
> session required pam_tty_audit.so enable=*
>
> in /etc/pam.d/sshd (or common-session)
>
> doesn't work due to bug #778664 [1]. How do you do that in Debian?
> Workarounds? Alternatives?
It does not allow tty snooping per se, but it logs all executed commands
by anyone (use '-F euid' to narrow the scope):
auditctl -a exit,always -F arch=b64 -S execve
auditctl -a exit,always -F arch=b32 -S execve
Reco
Reply to: