setting up auditd
Well I have a few problems and I can't find any good references on the net on how to do this. I have a RH Rel 4 system and it does not seem to be setup to run auditd (ok rpm reveals audit-0.5-1. but config file and device files non existent). And once i have that running I want to be able to have my own application write to the auditd . I understand audit-libs is required for that but have been unable to find it nor a procedure on how ot use it. I found some tid bits but they seem Rel 3 related.
Help!!!
Thanks,
Frank
Quoted 3 lines · geckiv
I have a RH Rel 4 system and it does not seem to be setup to run auditd (ok rpm reveals audit-0.5-1. but config file and device files non existent).
audit-0.5-1 is known not to work at all. You should upgrade to the latest in RHEL4, which is 1.0.14. You will need to install the audit-libs-devel package and you should have man pages for the API.
-Steve
I guess the only way to get that is to have a RH subscription?
Quoted 16 lines · Steve Grubb
Quoted 5 lines · geckiv
I have a RH Rel 4 system and it does not seem to be setup to run auditd (ok rpm reveals audit-0.5-1. but config file and device files non existent).
audit-0.5-1 is known not to work at all. You should upgrade to the latest in RHEL4, which is 1.0.14. You will need to install the audit-libs-devel package and you should have man pages for the API.
-Steve
Quoted 1 line · geckiv
I guess the only way to get that is to have a RH subscription?
I don't know about the availability of RHEL4 packages without having a subscription. There is CentOS but I can make no warantees about what's in it. You will also need the latest kernel and bunch of other updates for pam, login, ssh, and/or gdm. There are more packages that are trusted apps but that's the core.
-Steve