Problem with structure of authlog in regard to an external log Auditing system. Post: 302851545

Sponsored Content

Top Forums UNIX for Dummies Questions & Answers Problem with structure of authlog in regard to an external log Auditing system. Post 302851545 by Sjleegketting on Monday 9th of September 2013 08:03:44 AM

09-09-2013

Registered User

Problem with structure of authlog in regard to an external log Auditing system.

Hello everyone,

I hope I'm posting my question in the right section as it is not too easy to find the ideal spot for this one, especially for a brandspankingnew user of this forum. As this might be something simple I chose the Dummy section. By all means, feel free to move the post if not at the right place here.

The ArcSight auditing system deployed by my Security department has some troubles interpreting specific records in my managed system's auth_log. When a successful login is done you will see the next (anonimized) record logged in the auth_log:

Sep 9 13:49:49 SYSTEMNAME sshd[1613]: [ID 800047 auth.notice] Failed none for USERNAME from XX.XX.XX.XX port XXXX ssh2

I have marked the problematic piece of the sentence by making it bold. The specific part of the sentence "Failed none" unfortunately starts with "Failed" which makes our auditing system think it is a failed login, while it is a successful login.

Unfortunately a change on ArcSight side is out of the question as my system is apparently the only one using this odd phrasing according to support on that side. Switching off auth.notice is also out of the question because they need to be able to see successful logins, which would be gone if I'd disable auth.notice.

I have been looking into how i can manipulate the message logged in the auth_log, but I have been unable to find a befitting way to tackle this problem.

Systeminfo:
PAM seems to be installed and used
SunOS SYSTEMNAME 5.10 Generic_142900-10 sun4v sparc SUNW,Netra-T5440

The question now of course is, does someone know a way of manipulating this sentence structure without having to hack into the syslogger? I've found references to authentication order changing the logged message, but I have been unable to locate a guide that tells me how to do this.

Thanks in advance for your help guys!

Best regards,

Sjleegketting
The Netherlands

Last edited by Sjleegketting; 09-09-2013 at 09:15 AM.. Reason: forgot a quite important part of the problem.

Sjleegketting

View Public Profile for Sjleegketting

Find all posts by Sjleegketting

9 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

System Auditing

Hi all, Have been asked to learn up on providing Sytem Auditing on two SCO boxes. Where should I start and what pointers can anyone provide. Whilst I'm learning to look after these two SCO boxes, I'm also to eventually look after three Compaq DS20E True64 Unix boxes also in the near future.

2. UNIX for Dummies Questions & Answers

Problem w. case structure

Hello, I am having a problem setting a range of numbers for the "case" structure. I can use with no problems, but when I use it doesn't work??? Does the case struture allow numeric ranges? eg: echo -e "enter number between 0 and 60: \c" read $answer case $answer in ) echo...

3. Shell Programming and Scripting

with Regard to Case Statement

I need to check if $1 is A or B I tried the following but it seems its not correct..would appreciate a suggestion ? case "$1" in "A" || "B" ) ;; esac Thanks

4. Solaris

authlog

dear all does any one how to activate the log authlog on solaris

5. Shell Programming and Scripting

problem with listing of directory structure

Hi When im listing (ls -al ) its listing directories without / at the end of directories dir1 dir2 dir3 and i need to list directories with dir1/ dir2/ dir3/ and this should not be made by command ls -F / should be embedded at the last since one of the scripts reads directories...

6. Shell Programming and Scripting

copy directory structure to a system on the network

I am trying to write a script which has to copy the directory structure from my system to another system on the network. But I dont want the files to be copied. I think I have to start with copying all subdirectories names in a directory to a system on the network. Here's the case: Source...

7. Programming

Problem in static structure array in C

Hi, I have a following problem in C. I have a function A in which I used to call another function (function B) and pass an array of values through array variable by using below:- foo=functionB(array); In functionB, i used to just return some "values" (e.g return num;) in order to pass...

8. Shell Programming and Scripting

Bash script to process file without regard for case

Hello, I have a Bash script that processes a text file so that the existing file will look something like this: /www/repository/2010/201002231329532/LTLO_0407.pdf /www/repository/2010/201002231329532/LTLO_0507.pdf /www/repository/2010/201002231329532/LTLO_0607.pdf...

9. UNIX for Dummies Questions & Answers

Best way of System Logging and Auditing?

As part of server hardening process i would like to know the Best way of System Logging and Auditing. Following point should be taken into consideration. Logging of critical events Logging access to critical accounts Secure storage and availability of logs Review of logs Security of logs

LEARN ABOUT DEBIAN

eurephia-auth

eurephia-auth(7)														  eurephia-auth(7)

NAME

       eurephia-auth - The eurephia OpenVPN authentication plug-in

DESCRIPTION

       The eurephia-auth.so is a plug-in for OpenVPN.  It is loaded by providing the --plugin option in the OpenVPN configuration.

       The syntax for OpenVPN and eurephia-auth is:

	      plugin eurephia-auth.so "<plugin args> -- <DB args>"

       Please  notice  the  quotes  and  the double dash.  They are important markers so that the eurephia-auth module receives all arguments (the
       quotes) and that it knows when to pass on the rest of the arguments to the defined database driver, separated by  the  double  dash.   This
       manual  page  will  only  look at the <plugin args> options.  For the <DB args> options, refer to the corresponding database driver you are
       using.

OPTIONS

       --log-destination | -l
	      This defines how eurephia will do its logging. It can take a filename to log to a file. If the string is openvpn: it will  pass  the
	      log  data over to OpenVPN, which will combine the OpenVPN and eurephia logs. You can also log via syslog, by indicating syslog:. The
	      last possible special value is none: which will disable logging completely.

	      With syslog: you can also define which syslog facility the logging will go to. The default is to log to  the  user  facility.  Other
	      supported  facilities  are authpriv, daemon and local0 to local7. To send log data to the daemon the --log-destination argument need
	      to be

		  --log-destination syslog:daemon

       --log-level | -L
	      This defines how verbose the eurephia logging will be. The required argument to this option must be a numeric value, where  0  indi-
	      cates  as  little logging as possible - only giving informative messages, or a high value like 50 to give really verbose logging. In
	      general a log level less than 4 should be more than enough under normal circumstances.

	      NOTICE: The highest log level is 10, unless the eurephia-auth modules have been compiled with debug features.

       --database-interface | -i
	      This argument must have a full path to the eurephia database driver module. This defines which database interface eurephia will use.

OPENVPN CLIENTS

       The only change the OpenVPN clients needs to do is to add

	      auth-user-pass

       to their configuration file.  This instructs the OpenVPN client to ask for user name and password when starting the connection.

SEE ALSO

       eurephia-sqlite(8), eurephia_init(8)

AUTHOR

       Copyright (C) 2008-2010	David Sommerseth <dazo@users.sourceforge.net>

David Sommerseth						     July 2010							  eurephia-auth(7)