Sponsored Content
Full Discussion: Auditing device files
Operating Systems Linux Red Hat Auditing device files Post 302978073 by pavithra04 on Tuesday 26th of July 2016 03:10:59 AM
Old 07-26-2016
Auditing device files

I am trying to see what commands are typed in my terminal and serial port. For that I am using auditd daemon which helps me in auditing files.
I thought of a creating audit rules on /dev/tty and /dev/ttyAMA0 for seeing whats happening on terminal and serial device respectively.

Code:
   
auditctl -w /dev/tty -p rwx -k terminal

Code:
auditctl -w /dev/ttyAMA0 -p rwx -k serialport

But this records only the echo on tty. I cant audit all the commands typed on the terminal. I enabled tty logging in the PAM file too by adding
Code:
session required pam_tty_audit.so enable=*

in /etc/pam.d/sshd file.
Is there any other way to do this auditing. I want to use auditd daemon only so that all my auditing log is in one file.
 

10 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

how to read or write device files

hi everybody, i am working in device drivers.As a beginner to this field ,i dont know how to read or write device files. Will copy_to_user and copy_from_user help me? I have created a device file using mknod command .Can anybody help me in this regard :confused thanks in advance sriram (1 Reply)
Discussion started by: sriram.ec
1 Replies

2. HP-UX

Need to make disk device files match

Hi, I was wondering if there was a way to change the disk device files ex. /dev/dsk/cxtxd0 ? What I have are two HPUX 11.0 servers using MC Service Guard 11.13. A consultant attached a SAN and both servers had created the same identical LUN device files. Now I could begin creating my volume... (0 Replies)
Discussion started by: mvizza
0 Replies

3. Red Hat

My device files change!!!!

Hi... this is the situation. I have a server with redhat Advance Server 3 and the operating system is installed in /dev/sda disk... when i include new Luns dinamically they take the following special files /dev/sdb and /dev/sdc.... ok.. until now is everything ok... but the problem begins... (2 Replies)
Discussion started by: lenux78
2 Replies

4. Filesystems, Disks and Memory

hpux vg accessible but device files missing!

Hi all, I am looking at a MC cluster comprised of 2 nodes. There is a package named backup which does nothing more than mount a VG. At one point we noticed errors in syslog that look like this: cmclconfd: Could not access device file /dev/dsk/c20t0d0: No such file or directory There are... (1 Reply)
Discussion started by: mariusp
1 Replies

5. UNIX for Dummies Questions & Answers

Device Files names and location

HI there. I am studying System administration right now and am stuck on a question that I have failed to find the answer for in my book. The question is: Do device files need to be in the /dev directory and to they need to follow a naming convention? My answer (so far) is that since the... (7 Replies)
Discussion started by: Carl1976
7 Replies

6. HP-UX

tape device files constantly being recreated

Hi, We've been having problems with our NetWorker Silo servers (running HP-UX) concerning the tape device files under /dev/rmt. For some reason they are constantly being removed/recreated (up to a couple of times per hour): crw-rw-rw- 1 bin bin 205 0x240300 Apr 5 19:07... (1 Reply)
Discussion started by: piper28
1 Replies

7. Solaris

Auditing Individual Files

I have some Solaris 9 systems and I'm interested in using the "fm" audit class to track changes to sensitive files but it's too verbose for it to be auditing to that level for EVERY file, so I was wondering if there were a way of restricting the audit of those events to particular files. I... (0 Replies)
Discussion started by: thmnetwork
0 Replies

8. Red Hat

Unable To Activate Ethernet Network Device in RHEL 5.5 - e100 device eth0 does not seem to be presen

Hi All, Could anyone please help to resolve the below problem. I installed RHEL5.5 in my desktop.But when i try to activate the ethernet connection then it gives me the error. I spent 2 days for the above and go through with several suggestion found by googling. But no luck. ... (0 Replies)
Discussion started by: Tanmoy
0 Replies

9. HP-UX

Failed to open tape device /dev/rmt/0mn:Device busy (errno = 16)

Hi, Unable to make tape backup, please help. /opt/ignite/bin/make_tape_recovery -a /dev/rmt/?mn -I -v -m tar -x inc_entire=vg00 * Creating local directories for configuration files and archive. ======= 04/25/16 16:28:08 IST Started /opt/ignite/bin/make_tape_recovery. (Mon... (4 Replies)
Discussion started by: anuragr
4 Replies

10. UNIX for Beginners Questions & Answers

GPS Device not able to read xml files

Hi, new to Forum and I am not knowledgeable on any coding/encrypting or xml. Short version of my problem is this; My wife bought me a golf GPS unit years ago and the company was bought out by Callaway Golf and eventually discontinued. They dropped all support and website servers. This unit... (14 Replies)
Discussion started by: raidercruz
14 Replies
TTY(4)							     Linux Programmer's Manual							    TTY(4)

NAME
tty - controlling terminal DESCRIPTION
The file /dev/tty is a character file with major number 5 and minor number 0, usually of mode 0666 and owner.group root.tty. It is a syn- onym for the controlling terminal of a process, if any. In addition to the ioctl(2) requests supported by the device that tty refers to, the ioctl(2) request TIOCNOTTY is supported. TIOCNOTTY Detach the calling process from its controlling terminal. If the process is the session leader, then SIGHUP and SIGCONT signals are sent to the foreground process group and all processes in the current session lose their controlling tty. This ioctl(2) call only works on file descriptors connected to /dev/tty. It is used by daemon processes when they are invoked by a user at a terminal. The process attempts to open /dev/tty. If the open succeeds, it detaches itself from the terminal by using TIOCNOTTY, while if the open fails, it is obviously not attached to a terminal and does not need to detach itself. FILES
/dev/tty SEE ALSO
chown(1), mknod(1), ioctl(2), termios(3), console(4), tty_ioctl(4), ttyS(4), agetty(8), mingetty(8) COLOPHON
This page is part of release 3.44 of the Linux man-pages project. A description of the project, and information about reporting bugs, can be found at http://www.kernel.org/doc/man-pages/. Linux 2003-04-07 TTY(4)
All times are GMT -4. The time now is 01:26 AM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy