09-09-2013
Problem with structure of authlog in regard to an external log Auditing system.
Hello everyone,
I hope I'm posting my question in the right section as it is not too easy to find the ideal spot for this one, especially for a brandspankingnew user of this forum. As this might be something simple I chose the Dummy section. By all means, feel free to move the post if not at the right place here.
The ArcSight auditing system deployed by my Security department has some troubles interpreting specific records in my managed system's auth_log. When a successful login is done you will see the next (anonimized) record logged in the auth_log:
Sep 9 13:49:49 SYSTEMNAME sshd[1613]: [ID 800047 auth.notice] Failed none for USERNAME from XX.XX.XX.XX port XXXX ssh2
I have marked the problematic piece of the sentence by making it bold. The specific part of the sentence "Failed none" unfortunately starts with "Failed" which makes our auditing system think it is a failed login, while it is a successful login.
Unfortunately a change on ArcSight side is out of the question as my system is apparently the only one using this odd phrasing according to support on that side. Switching off auth.notice is also out of the question because they need to be able to see successful logins, which would be gone if I'd disable auth.notice.
I have been looking into how i can manipulate the message logged in the auth_log, but I have been unable to find a befitting way to tackle this problem.
Systeminfo:
PAM seems to be installed and used
SunOS SYSTEMNAME 5.10 Generic_142900-10 sun4v sparc SUNW,Netra-T5440
The question now of course is, does someone know a way of manipulating this sentence structure without having to hack into the syslogger? I've found references to authentication order changing the logged message, but I have been unable to locate a guide that tells me how to do this.
Thanks in advance for your help guys!
Best regards,
Sjleegketting
The Netherlands
Last edited by Sjleegketting; 09-09-2013 at 09:15 AM..
Reason: forgot a quite important part of the problem.
9 More Discussions You Might Find Interesting
1. UNIX for Dummies Questions & Answers
Hi all,
Have been asked to learn up on providing Sytem Auditing on two SCO boxes.
Where should I start and what pointers can anyone provide.
Whilst I'm learning to look after these two SCO boxes, I'm also to eventually look after three Compaq DS20E True64 Unix boxes also in the near future. (2 Replies)
Discussion started by: Cameron
2 Replies
2. UNIX for Dummies Questions & Answers
Hello,
I am having a problem setting a range of numbers for the "case" structure.
I can use with no problems, but
when I use it doesn't work???
Does the case struture allow numeric ranges?
eg:
echo -e "enter number between 0 and 60: \c"
read $answer
case $answer in
) echo... (2 Replies)
Discussion started by: Joe54321
2 Replies
3. Shell Programming and Scripting
I need to check if $1 is A or B
I tried the following but it seems its not correct..would appreciate a suggestion ?
case "$1"
in
"A" || "B" )
;;
esac
Thanks (4 Replies)
Discussion started by: cosec
4 Replies
4. Solaris
dear all
does any one how to activate the log authlog on solaris (3 Replies)
Discussion started by: murad.jaber
3 Replies
5. Shell Programming and Scripting
Hi
When im listing (ls -al ) its listing directories without / at the end of directories
dir1 dir2 dir3
and i need to list directories with
dir1/ dir2/ dir3/ and this should not be made by command ls -F
/ should be embedded at the last
since one of the scripts reads directories... (1 Reply)
Discussion started by: vasanthan
1 Replies
6. Shell Programming and Scripting
I am trying to write a script which has to copy the directory structure from my system to another system on the network. But I dont want the files to be copied.
I think I have to start with copying all subdirectories names in a directory to a system on the network.
Here's the case:
Source... (1 Reply)
Discussion started by: firefox211
1 Replies
7. Programming
Hi,
I have a following problem in C.
I have a function A in which I used to call another function (function B) and pass an array of values through array variable by using below:-
foo=functionB(array);
In functionB, i used to just return some "values" (e.g return num;) in order to pass... (1 Reply)
Discussion started by: ahjiefreak
1 Replies
8. Shell Programming and Scripting
Hello,
I have a Bash script that processes a text file so that the existing file will look something like this:
/www/repository/2010/201002231329532/LTLO_0407.pdf
/www/repository/2010/201002231329532/LTLO_0507.pdf
/www/repository/2010/201002231329532/LTLO_0607.pdf... (1 Reply)
Discussion started by: manouche
1 Replies
9. UNIX for Dummies Questions & Answers
As part of server hardening process i would like to know the Best way of System Logging and Auditing.
Following point should be taken into consideration.
Logging of critical events
Logging access to critical accounts
Secure storage and availability of logs
Review of logs
Security of logs (4 Replies)
Discussion started by: pinga123
4 Replies
LEARN ABOUT CENTOS
fingerprint-auth-ac
SYSTEM-AUTH-AC(5) File Formats Manual SYSTEM-AUTH-AC(5)
NAME
system-auth-ac, password-auth-ac, smartcard-auth-ac, fingerprint-auth-ac, postlogin-ac - Common configuration files for PAMified services
written by authconfig(8)
SYNOPSIS
/etc/pam.d/system-auth-ac
DESCRIPTION
The purpose of this configuration file is to provide common configuration file for all applications and service daemons calling PAM
library.
The system-auth configuration file is included from all individual service configuration files with the help of the include directive. When
authconfig(8) writes the system PAM configuration file it replaces the default system-auth file with a symlink pointing to system-auth-ac
and writes the configuration to this file. The symlink is not changed on subsequent configuration changes even if it points elsewhere. This
allows system administrators to override the configuration written by authconfig.
The authconfig now writes the authentication modules also into additional PAM configuration files /etc/pam.d/password-auth-ac,
/etc/pam.d/smartcard-auth-ac, and /etc/pam.d/fingerprint-auth-ac. These configuration files contain only modules which perform authentica-
tion with the respective kinds of authentication tokens. For example /etc/pam.d/smartcard-auth[-ac] will not contain pam_unix and pam_ldap
modules and /etc/pam.d/password-auth[-ac] will not contain pam_pkcs11 and pam_fprintd modules.
The file /etc/pam.d/postlogin-ac contains common services to be invoked after login. An example can be a module that encrypts an user's
filesystem or user's keyring and is decrypted by his password.
The PAM configuration files of services which are accessed by remote connections such as sshd or ftpd now include the /etc/pam.d/password-
auth configuration file instead of /etc/pam.d/system-auth.
EXAMPLE
Configure system to use pam_tally2 for configuration of maximum number of failed logins. Also call pam_access to verify if access is
allowed.
Make system-auth symlink point to system-auth-local which contains:
auth requisite pam_access.so
auth requisite pam_tally2.so deny=3 lock_time=30
unlock_time=3600
auth include system-auth-ac
account required pam_tally2.so
account include system-auth-ac
password include system-auth-ac
session include system-auth-ac
BUGS
None known.
SEE ALSO
authconfig(8), authconfig-gtk(8), pam(8), system-auth(5)
Red Hat, Inc. 2010 March 31 SYSTEM-AUTH-AC(5)