freebsd security - Jun 2011 - More questions about audit

Hello, Freebsd-security.

 I'm grepping all sources for programs, which support audit and found
strange thing:

 find . -name '*.c*' -print | \
   grep -v -E '^./(sys|contrib/openbsm|tools/regression)' | \
   xargs grep -E "\<(audit|au_)"

 shows, that only login(1), su(1), id(1) and sshd(1) uses audit. And
 even sshd(8) raise question: it doesn't call setaudit(2)!

 Even more, such command doesn't show anything about user login via
 ssh:

 auditreduce -m AUE_login /dev/auditpipe0 | praudit

 Yes, I have "lo" class enabled for all users, and, yes,

 auditreduce -r USER /dev/auditpipe0 | praudit

 shows activity after login...

 What do I do wrong?


P.S. Maybe, here is more adequate list for BSM Audit questions?

-- 
// Black Lion AKA Lev Serebryakov <lev@FreeBSD.org>

On 29 juin 2011, at 17:11, Lev Serebryakov wrote:
> Even more, such command doesn't show anything about user login via
> ssh:
> 
> auditreduce -m AUE_login /dev/auditpipe0 | praudit
> 
> Yes, I have "lo" class enabled for all users, and, yes,
> 
> auditreduce -r USER /dev/auditpipe0 | praudit
> 
> shows activity after login...
# praudit -l /dev/auditpipe0
header,99,11,OpenSSH login,0,Wed Jun 29 21:21:22 2011, + 603
msec,subject_ex,*******,text,successful login
patpro,return,success,0,trailer,99,
header,481,11,execve(2),0,Wed Jun 29 21:21:22 2011, + 668 msec,exec
arg,-bash,exec env,*******,return,success,0,trailer,481,
../..
header,94,11,logout - local,0,Wed Jun 29 21:21:25 2011, + 328
msec,subject_ex,*******,text,sshd logout patpro,return,success,0,trailer,94,

You see "OpenSSH login" as event's name. That's what you need
to look for:

# grep "OpenSSH login" /etc/security/audit_event 
32800:AUE_openssh:OpenSSH login:lo

so, you must try:

# auditreduce -m AUE_openssh /dev/auditpipe0 | praudit

But I don't get good results with that command. It looks like auditreduce
wait for a good amount of events before sending the result to stdout. This will
show your logins :

# auditreduce -m AUE_openssh /var/audit/current | praudit



patpro